CVE-2024-0340: Kernel: information disclosure in vhost/vhost.c:vhost_new_msg()

A vulnerability was found in vhostnewmsg in drivers/vhost/vhost.c in the Linux kernel. This flaw does not properly initialize memory in messages passed between virtual guests and the host operating system in the vhost/vhost.c:vhostnewmsg() function. This can allow local privileged users to read some kernel memory contents when reading from the /dev/vhost-net device file.

References: https://lore.kernel.org/lkml/5kn47peabxjrptkqa6dwtyus35ahf4pcj4qm4pumse33kxqpjw@mec4se5relrc/T/

— Red Hat

Kernel: information disclosure in vhost/vhost.c:vhostnewmsg()

— Microsoft

Linux Kernel could allow a local authenticated attacker to obtain sensitive information, caused by a flaw in the vhostnewmsg function in drivers/vhost/vhost.c. By reading the /dev/vhost-net device file, an attacker could exploit this vulnerability to obtain kernel memory information, and use this information to launch further attacks against the affected system.

— IBM