CVE-2022-49882

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

KVM: Reject attempts to consume or refresh inactive gfn_to_pfn_cache

Reject kvm_gpc_check() and kvm_gpc_refresh() if the cache is inactive.

Not checking the active flag during refresh is particularly egregious, as

KVM can end up with a valid, inactive cache, which can lead to a variety

of use-after-free bugs, e.g. consuming a NULL kernel pointer or missing

an mmu_notifier invalidation due to the cache not being on the list of

gfns to invalidate.

Note, "active" needs to be set if and only if the cache is on the list

of caches, i.e. is reachable via mmu_notifier events. If a relevant

mmu_notifier event occurs while the cache is "active" but not on the

list, KVM will not acquire the cache's lock and so will not serailize

the mmu_notifier event with active users and/or kvm_gpc_refresh().

A race between KVM_XEN_ATTR_TYPE_SHARED_INFO and KVM_XEN_HVM_EVTCHN_SEND

can be exploited to trigger the bug.

1. Deactivate shinfo

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References