CVE-2022-49884

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

KVM: Initialize gfn_to_pfn_cache locks in dedicated helper

Move the gfn_to_pfn_cache lock initialization to another helper and

call the new helper during VM/vCPU creation. There are race

conditions possible due to kvm_gfn_to_pfn_cache_init()'s

ability to re-initialize the cache's locks.

For example: a race between ioctl(KVM_XEN_HVM_EVTCHN_SEND) and

kvm_gfn_to_pfn_cache_init() leads to a corrupted shinfo gpc lock.

(thread 1) | (thread 2)

|

kvm_xen_set_evtchn_fast |

read_lock_irqsave(&gpc->lock, ...) |

| kvm_gfn_to_pfn_cache_init

| rwlock_init(&gpc->lock)

read_unlock_irqrestore(&gpc->lock, ...) |

Rename "cache_init" and "cache_destroy" to activate+deactivate to

avoid implying that the cache really is destroyed/freed.

Note,

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References