CVE-2024-53110

What it actually does

The vhost_vdpa driver allocates an id_table without an extra virtio_device_id entry as null terminator, allowing vdpa_mgmtdev_get_classes() to iterate past the end and access undefined memory.

Why it matters to the business

Affected Linux systems may experience kernel instability or crashes during vdpa device management, disrupting virtualization and networking workloads until patched.

How an attack unfolds

An attacker with local access triggers vhost_vdpa device registration or management operations; the missing terminator causes the iteration function to read uninitialized memory, leading to denial of service via kernel panic or oops.

How to fix it

Update the Linux kernel to commit 870d68fe17b5d9032049dcad98b5781a344a8657 or a later stable release containing the one-extra-entry allocation fix. Apply distribution-specific kernel updates that include this change.

How to confirm the fix worked

Confirm the fix by inspecting the vhost_vdpa id_table allocation site for the added null-terminator entry and verify the presence of commit 870d68fe17b5d9032049dcad98b5781a344a8657 in the kernel git history.

Typical attack path

1. Obtain local access on an affected Linux system
2. Trigger vhost_vdpa or vdpa_mgmtdev operations that invoke get_classes()
3. Cause out-of-bounds memory read resulting in kernel crash

How to detect it

Review kernel logs and dmesg output for oops, panics, or warnings originating from vhost_vdpa, vdpa_mgmtdev_get_classes, or related virtio/vdpa code paths around device registration events.

What your security team should do

• Apply the kernel fix immediately on systems exposing vhost_vdpa or vdpa functionality
• Monitor kernel logs for vdpa-related oops or panics until patches are deployed
• Limit local user access on unpatched systems where feasible