From: "Michael S. Tsirkin" <mst@redhat.com>
To: 성병찬 <tjdqudcks0424@naver.com>
Cc: "James E . J . Bottomley" <James.Bottomley@hansenpartnership.com>,
"Martin K . Petersen" <mkp@kernel.org>,
Jason Wang <jasowangio@gmail.com>,
linux-scsi@vger.kernel.org, virtualization@lists.linux.dev,
linux-kernel@vger.kernel.org, security@kernel.org
Subject: Re: [BUG] scsi: short virtio-scsi VPD response exposes stale heap data
Date: Tue, 6 Oct 2026 05:49:51 -0400 [thread overview]
Message-ID: <20261006054845-mutt-send-email-mst@kernel.org> (raw)
In-Reply-To: <96622e4086e5fb77b8148631fa6ca16e@cweb003.nm>
On Tue, Oct 06, 2026 at 06:40:54PM +0900, 성병찬 wrote:
> Yes, that is a fair summary.
>
> More precisely, a short successful virtio-scsi response causes the
> guest kernel to cache bytes that were not supplied by the device and
> expose them through the world-readable VPD sysfs attribute.
>
> The guest-kernel heap disclosure is reproducible. I agree that its
> security classification depends on whether the virtio-scsi
> device/backend is considered trusted in the relevant threat model.
>
> Would validating and propagating the actual virtqueue used length be
> worthwhile as a robustness fix?
>
> Regards,
> sungbyeongchan
>
I think so but please copy all relevant maintainers.
./scripts/get_maintainer.pl -f drivers/scsi/virtio_scsi.c
"Michael S. Tsirkin" <mst@redhat.com> (maintainer:VIRTIO BLOCK AND SCSI DRIVERS)
Jason Wang <jasowangio@gmail.com> (maintainer:VIRTIO BLOCK AND SCSI DRIVERS)
Paolo Bonzini <pbonzini@redhat.com> (reviewer:VIRTIO BLOCK AND SCSI DRIVERS)
Stefan Hajnoczi <stefanha@redhat.com> (reviewer:VIRTIO BLOCK AND SCSI DRIVERS)
"Eugenio Pérez" <eperezma@redhat.com> (reviewer:VIRTIO BLOCK AND SCSI DRIVERS)
"James E.J. Bottomley" <James.Bottomley@HansenPartnership.com> (maintainer:SCSI SUBSYSTEM)
"Martin K. Petersen" <mkp@kernel.org> (maintainer:SCSI SUBSYSTEM)
virtualization@lists.linux.dev (open list:VIRTIO BLOCK AND SCSI DRIVERS)
linux-scsi@vger.kernel.org (open list:SCSI SUBSYSTEM)
linux-kernel@vger.kernel.org (open list)
--
MST
prev parent reply other threads:[~2026-10-06 9:50 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-06 9:11 [BUG] scsi: short virtio-scsi VPD response exposes stale heap data sungbyeongchan
2026-10-06 9:25 ` Michael S. Tsirkin
2026-10-06 9:40 ` 성병찬
2026-10-06 9:49 ` Michael S. Tsirkin [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261006054845-mutt-send-email-mst@kernel.org \
--to=mst@redhat.com \
--cc=James.Bottomley@hansenpartnership.com \
--cc=jasowangio@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-scsi@vger.kernel.org \
--cc=mkp@kernel.org \
--cc=security@kernel.org \
--cc=tjdqudcks0424@naver.com \
--cc=virtualization@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.