CVE-2022-49884

Description

In the Linux kernel, the following vulnerability has been resolved: KVM: Initialize gfn_to_pfn_cache locks in dedicated helper Move the gfn_to_pfn_cache lock initialization to another helper and call the new helper during VM/vCPU creation. There are race conditions possible due to kvm_gfn_to_pfn_cache_init()'s ability to re-initialize the cache's locks. For example: a race between ioctl(KVM_XEN_HVM_EVTCHN_SEND) and kvm_gfn_to_pfn_cache_init() leads to a corrupted shinfo gpc lock. (thread 1) | (thread 2) | kvm_xen_set_evtchn_fast | read_lock_irqsave(&gpc->lock, ...) | | kvm_gfn_to_pfn_cache_init | rwlock_init(&gpc->lock) read_unlock_irqrestore(&gpc->lock, ...) | Rename "cache_init" and "cache_destroy" to activate+deactivate to avoid implying that the cache really is destroyed/freed. Note, there more races in the newly named kvm_gpc_activate() that will be addressed separately. [sean: call out that this is a bug fix]

Reserved 2025-05-01 | Published 2025-05-01 | Updated 2025-05-04 | Assigner Linux

Product status

Default status
unaffected

982ed0de4753ed6e71dbd40f82a5a066baf133ed before 61242001d6c9c253df7645dab090842d8da08764
affected

982ed0de4753ed6e71dbd40f82a5a066baf133ed before 52491a38b2c2411f3f0229dc6ad610349c704a41
affected

Default status
affected

5.17
affected

Any version before 5.17
unaffected

6.0.8
unaffected

6.1
unaffected

References

git.kernel.org/...c/61242001d6c9c253df7645dab090842d8da08764

git.kernel.org/...c/52491a38b2c2411f3f0229dc6ad610349c704a41

cve.org (CVE-2022-49884)

nvd.nist.gov (CVE-2022-49884)

Download JSON