CVE-2022-48862

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

vhost: fix hung thread due to erroneous iotlb entries

In vhost_iotlb_add_range_ctx(), range size can overflow to 0 when

start is 0 and last is ULONG_MAX. One instance where it can happen

is when userspace sends an IOTLB message with iova=size=uaddr=0

(vhost_process_iotlb_msg). So, an entry with size = 0, start = 0,

last = ULONG_MAX ends up in the iotlb. Next time a packet is sent,

iotlb_access_ok() loops indefinitely due to that erroneous entry.

Call Trace:

<TASK>

iotlb_access_ok+0x21b/0x3e0 drivers/vhost/vhost.c:1340

vq_meta_prefetch+0xbc/0x280 drivers/vhost/vhost.c:1366

vhost_transport_do_send_pkt+0xe0/0xfd0 drivers/vhost/vsock.c:104

vhost_worker+0x23d/0x3d0 drivers/vhost/vhost.c:372

kthread+0x2e9/0x3a0 kernel/kthread.c:377

ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

</TASK>

Reported by syzbot at:

https://syzkaller.appspot.com/bug?extid=0abd373e2e50d704db87

To fix this, do two things:

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References