Bug 2293254 (CVE-2021-47575)

Summary:	CVE-2021-47575 kernel: xen/console: harden hvc_xen against event channel storms
Product:	[Other] Security Response	Reporter:	Avinash Hanwate <ahanwate>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	dfreiber, drow, jburrell, mbenatto, vkumar
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	kernel 4.4.296, kernel 4.9.294, kernel 4.14.259, kernel 4.19.222, kernel 5.4.168, kernel 5.10.88, kernel 5.15.11, kernel 5.16	Doc Type:	If docs needed, set a value
Doc Text:	[REJECTED CVE] The Xen console driver (hvc_xen) has a bug in event channel storms, where an excessive number of events sent by the backend could overwhelm the system. The issue stemmed from sending events even when no bytes were read from the backend, causing unnecessary interrupts. Additionally, during the domU initial console setup, there was no XenBus device available when the event channel was bound, complicating event handling.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2293209

Description Avinash Hanwate 2024-06-20 11:05:51 UTC

In the Linux kernel, the following vulnerability has been resolved:

xen/console: harden hvc_xen against event channel storms

The Linux kernel CVE team has assigned CVE-2021-47575 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024061914-CVE-2021-47575-a011@gregkh/T

Comment 10 TEJ RATHI 2024-11-26 12:54:17 UTC

This CVE has been rejected upstream:
https://lore.kernel.org/linux-cve-announce/2024062012-REJECTED-9525@gregkh/