description: Guest triggered use-after-free in Linux xen-netback A malicious or buggy network PV frontend can force Linux netback to disable the interface and terminate the receive kernel thread associated with queue 0 in response to the frontend sending a malformed packet. Such kernel thread termination will lead to a use-after-free in Linux netback when the backend is destroyed, as the kernel thread associated with queue 0 will have already exited and thus the call to kthread_stop will be performed against a stale pointer.
problem types: unknown
affected:
{
product: Linux
vendor: Linux
versions:
lessThan: 4.12, status: unknown, version: unspecified, versionType: custom
lessThan: unspecified, status: affected, version: 5.5.0, versionType: custom
lessThan: unspecified, status: unaffected, version: next of 5.12.2, versionType: custom
}
metrics:
other: [
content: {'description': {'description_data': [{'lang': 'eng', 'value': 'A malicious or buggy frontend driver can trigger a dom0 crash.\nPrivilege escalation and information leaks cannot be ruled out.'}]}}
type: unknown
]