CVE-2021-47604

What it actually does

Out-of-bounds read in nvduse get_config() due to missing offset validation against dev->config_size; unsigned subtraction produces a large value allowing memory access beyond intended bounds.

Why it matters to the business

Kernel-level information disclosure or denial of service on affected Linux systems, potentially disrupting virtualization or storage workloads that rely on the nvduse driver.

How an attack unfolds

An attacker supplies a vhost_vdpa_config request with an offset exceeding the device's config_size; the unchecked subtraction yields an oversized read length, exposing adjacent kernel memory.

How to fix it

Apply the upstream fix that adds an explicit bounds check on offset in get_config(); rebuild and deploy updated kernel packages to all affected hosts.

How to confirm the fix worked

Confirm the presence of the offset bounds check in the nvduse driver source; verify running kernel versions contain the patch and test config queries with out-of-range offsets return errors rather than data.

Typical attack path

1. Identify a system exposing nvduse/vhost_vdpa interfaces
2. Craft a config query with offset greater than config_size
3. Trigger the get_config path via the vhost ioctl
4. Read the resulting out-of-bounds kernel memory for sensitive data or to induce a crash

How to detect it

Search kernel logs and audit trails for nvduse-related oops, warnings about config_size, or unusual vhost ioctl sequences; correlate with process activity using the nvduse module.

What your security team should do

• Prioritize kernel updates on hosts using virtio or nvduse device emulation
• Review any custom vhost_vdpa integrations for similar validation gaps
• Monitor kernel logs for unexpected oops or page faults originating from nvduse