CVE-2023-5158

What it actually does

A zero-length descriptor passed to vringh_kiov_advance in the host-side virtio ring handling code triggers a denial of service that crashes or hangs the host kernel from within a guest.

Why it matters to the business

Virtualized workloads on affected Linux hosts can be disrupted by a malicious or compromised guest, leading to host reboots, service outages, and loss of availability for any tenants sharing the same physical system; the issue has been public for over three years with negligible observed exploitation.

How an attack unfolds

An attacker with control of a guest VM constructs a virtio descriptor ring entry containing a zero-length buffer and submits it to the host vhost/vringh path; the kernel function vringh_kiov_advance fails to handle the edge case, resulting in a host-side crash or hang.

How to fix it

Upgrade to a Linux kernel version that contains the fix for the zero-length descriptor handling in drivers/vhost/vringh.c; if no updated package is available, isolate untrusted guests or disable vhost-based virtio devices where operationally feasible.

How to confirm the fix worked

Verify the running kernel version against vendor advisory lists, inspect the vringh.c source for the corrected length check, and confirm that zero-length descriptors no longer cause a host crash under test workloads.

Typical attack path

1. Obtain code execution or control inside a guest virtual machine
2. Craft and submit a virtio descriptor ring containing a zero-length entry
3. Trigger the vringh_kiov_advance path on the host
4. Cause host kernel panic or hang, denying service to the host and other guests

How to detect it

Examine kernel logs (dmesg, /var/log/kern.log, journalctl) for oops or panic messages referencing vringh_kiov_advance or drivers/vhost/vringh.c; correlate guest virtio activity spikes with host crashes.

What your security team should do

• Prioritize kernel updates on hosts that run untrusted or multi-tenant guests
• Review and restrict virtio/vhost device exposure to guests where possible
• Monitor kernel crash logs for vringh-related oops entries until patches are applied