CVE-2022-49557

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

x86/fpu: KVM: Set the base guest FPU uABI size to sizeof(struct kvm_xsave)

Set the starting uABI size of KVM's guest FPU to 'struct kvm_xsave',

i.e. to KVM's historical uABI size. When saving FPU state for usersapce,

KVM (well, now the FPU) sets the FP+SSE bits in the XSAVE header even if

the host doesn't support XSAVE. Setting the XSAVE header allows the VM

to be migrated to a host that does support XSAVE without the new host

having to handle FPU state that may or may not be compatible with XSAVE.

Setting the uABI size to the host's default size results in out-of-bounds

writes (setting the FP+SSE bits) and data corruption (that is thankfully

caught by KASAN) when running on hosts without XSAVE, e.g. on Core2 CPUs.

WARN if the default size is larger than KVM's historical uABI size; all

features that can push the FPU size beyond the historical size must be

opt-in.

===============================================

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References