CVE-2022-48764

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86: Free kvm_cpuid_entry2 array on post-KVM_RUN KVM_SET_CPUID{,2}

Free the "struct kvm_cpuid_entry2" array on successful post-KVM_RUN

KVM_SET_CPUID{,2} to fix a memory leak, the callers of kvm_set_cpuid()

free the array only on failure.

BUG: memory leak

unreferenced object 0xffff88810963a800 (size 2048):

comm "syz-executor025", pid 3610, jiffies 4294944928 (age 8.080s)

hex dump (first 32 bytes):

00 00 00 00 00 00 00 00 00 00 00 00 0d 00 00 00 ................

47 65 6e 75 6e 74 65 6c 69 6e 65 49 00 00 00 00 GenuntelineI....

backtrace:

[<ffffffff814948ee>] kmalloc_node include/linux/slab.h:604 [inline]

[<ffffffff814948ee>] kvmalloc_node+0x3e/0x100 mm/util.c:580

[<ffffffff814950f2>] kvmalloc include/linux/slab.h:732 [inline]

[<ffffffff814950f2>] vmemdup_user+0x22/0x100 mm/util.c:199

[<ffffffff8109f5ff>] kvm_vcpu_ioctl_set_cpuid2+0x8f/0xf0 arch/x86/kvm/cpuid.c:423

[<ffffff

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References