Linux Kernel vhost-scsi Vulnerability in Log Management

A vulnerability in the Linux kernel's vhost-scsi component has been addressed. The issue arose because the completion path could access the vq->log_base variable when vq->log_used was already set to false. This created a scenario where invalid memory writes could occur to QEMU userspace, potentially leading to memory corruption. The problem was caused by improper synchronization between the logging mechanism and the associated mutex, allowing for unsafe access to user-space memory.

Impact

Exploitation of this vulnerability could lead to memory corruption in QEMU userspace, allowing for invalid memory writes that could be exploited to cause further issues, such as arbitrary code execution or creating a denial-of-service condition by crashing the QEMU process.