The biomapuseriov and biounmapuser functions in block/bio.c in the Linux kernel before 4.13.8 do unbalanced refcounting when a SCSI I/O vector has small consecutive buffers belonging to the same page. The bioaddpcpage function merges them into one, but the page reference is never dropped. This causes a memory leak and possible system lockup (exploitable against the host OS by a guest OS user, if a SCSI disk is passed through to a virtual machine) due to an out-of-memory condition.
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-12190.json"
[
{
"id": "CVE-2017-12190-a44a6110",
"target": {
"function": "bio_map_user_iov",
"file": "block/bio.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@95d78c28b5a85bacbc29b8dba7c04babb9b0d467",
"digest": {
"function_hash": "320845639308813257743559807033931063322",
"length": 1805.0
},
"signature_type": "Function"
},
{
"id": "CVE-2017-12190-d9f97e56",
"target": {
"file": "block/bio.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@95d78c28b5a85bacbc29b8dba7c04babb9b0d467",
"digest": {
"threshold": 0.9,
"line_hashes": [
"216812037287081387604351688808544786344",
"131281349831753645498606185851463043816",
"132969324905086407529611376105034937129",
"183674442660889923774668887522427420072",
"141153650936547776465713916293322591308",
"48788668938252169466417369835416596521",
"302190580937633253264198744084705916453"
]
},
"signature_type": "Line"
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-12190.json"
[
{
"id": "CVE-2017-12190-e995d9c0",
"target": {
"file": "block/bio.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://github.com/torvalds/linux/commit/95d78c28b5a85bacbc29b8dba7c04babb9b0d467",
"digest": {
"threshold": 0.9,
"line_hashes": [
"216812037287081387604351688808544786344",
"131281349831753645498606185851463043816",
"132969324905086407529611376105034937129",
"183674442660889923774668887522427420072",
"141153650936547776465713916293322591308",
"48788668938252169466417369835416596521",
"302190580937633253264198744084705916453"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2017-12190-f4a1d928",
"target": {
"function": "bio_map_user_iov",
"file": "block/bio.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://github.com/torvalds/linux/commit/95d78c28b5a85bacbc29b8dba7c04babb9b0d467",
"digest": {
"function_hash": "320845639308813257743559807033931063322",
"length": 1805.0
},
"signature_type": "Function"
}
]