CVE-2022-49559

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2022-49559
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-49559.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-49559
Downstream
Related
Published
2025-02-26T02:14:05Z
Modified
2025-10-21T10:39:35.325117Z
Summary
KVM: x86: Drop WARNs that assert a triple fault never "escapes" from L2
Details

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86: Drop WARNs that assert a triple fault never "escapes" from L2

Remove WARNs that sanity check that KVM never lets a triple fault for L2 escape and incorrectly end up in L1. In normal operation, the sanity check is perfectly valid, but it incorrectly assumes that it's impossible for userspace to induce KVMREQTRIPLEFAULT without bouncing through KVMRUN (which guarantees kvmchecknested_state() will see and handle the triple fault).

The WARN can currently be triggered if userspace injects a machine check while L2 is active and CR4.MCE=0. And a future fix to allow save/restore of KVMREQTRIPLE_FAULT, e.g. so that a synthesized triple fault isn't lost on migration, will make it trivially easy for userspace to trigger the WARN.

Clearing KVMREQTRIPLE_FAULT when forcibly leaving guest mode is tempting, but wrong, especially if/when the request is saved/restored, e.g. if userspace restores events (including a triple fault) and then restores nested state (which may forcibly leave guest mode). Ignoring the fact that KVM doesn't currently provide the necessary APIs, it's userspace's responsibility to manage pending events during save/restore.

------------[ cut here ]------------ WARNING: CPU: 7 PID: 1399 at arch/x86/kvm/vmx/nested.c:4522 nestedvmxvmexit+0x7fe/0xd90 [kvmintel] Modules linked in: kvmintel kvm irqbypass CPU: 7 PID: 1399 Comm: statetest Not tainted 5.17.0-rc3+ #808 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:nestedvmxvmexit+0x7fe/0xd90 [kvmintel] Call Trace: <TASK> vmxleavenested+0x30/0x40 [kvmintel] vmxsetnestedstate+0xca/0x3e0 [kvmintel] kvmarchvcpuioctl+0xf49/0x13e0 [kvm] kvmvcpuioctl+0x4b9/0x660 [kvm] _x64sysioctl+0x83/0xb0 dosyscall64+0x3b/0xc0 entrySYSCALL64after_hwframe+0x44/0xae </TASK> ---[ end trace 0000000000000000 ]---

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
cb6a32c2b8777ad31a02e585584d869251a790e3
Fixed
8d3a2aa0976f57320ba89baf9d57fb158dd0cd0d
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
cb6a32c2b8777ad31a02e585584d869251a790e3
Fixed
f476a59d5c86c02a79eef893c6da86735f2977ac
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
cb6a32c2b8777ad31a02e585584d869251a790e3
Fixed
7de373c9b48229e428ecdb8fbde269c5a8617fd2
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
cb6a32c2b8777ad31a02e585584d869251a790e3
Fixed
45846661d10422ce9e22da21f8277540b29eca22

Affected versions

v5.*

v5.12
v5.12-rc4
v5.12-rc5
v5.12-rc6
v5.12-rc7
v5.12-rc8
v5.13
v5.13-rc1
v5.13-rc2
v5.13-rc3
v5.13-rc4
v5.13-rc5
v5.13-rc6
v5.13-rc7
v5.14
v5.14-rc1
v5.14-rc2
v5.14-rc3
v5.14-rc4
v5.14-rc5
v5.14-rc6
v5.14-rc7
v5.15
v5.15-rc1
v5.15-rc2
v5.15-rc3
v5.15-rc4
v5.15-rc5
v5.15-rc6
v5.15-rc7
v5.15.1
v5.15.10
v5.15.11
v5.15.12
v5.15.13
v5.15.14
v5.15.15
v5.15.16
v5.15.17
v5.15.18
v5.15.19
v5.15.2
v5.15.20
v5.15.21
v5.15.22
v5.15.23
v5.15.24
v5.15.25
v5.15.26
v5.15.27
v5.15.28
v5.15.29
v5.15.3
v5.15.30
v5.15.31
v5.15.32
v5.15.33
v5.15.34
v5.15.35
v5.15.36
v5.15.37
v5.15.38
v5.15.39
v5.15.4
v5.15.40
v5.15.41
v5.15.42
v5.15.43
v5.15.44
v5.15.5
v5.15.6
v5.15.7
v5.15.8
v5.15.9
v5.16
v5.16-rc1
v5.16-rc2
v5.16-rc3
v5.16-rc4
v5.16-rc5
v5.16-rc6
v5.16-rc7
v5.16-rc8
v5.17
v5.17-rc1
v5.17-rc2
v5.17-rc3
v5.17-rc4
v5.17-rc5
v5.17-rc6
v5.17-rc7
v5.17-rc8
v5.17.1
v5.17.10
v5.17.11
v5.17.12
v5.17.2
v5.17.3
v5.17.4
v5.17.5
v5.17.6
v5.17.7
v5.17.8
v5.17.9
v5.18
v5.18-rc1
v5.18-rc2
v5.18-rc3
v5.18-rc4
v5.18-rc5
v5.18-rc6
v5.18-rc7
v5.18.1

Database specific

vanir_signatures

[
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f476a59d5c86c02a79eef893c6da86735f2977ac",
        "target": {
            "function": "nested_svm_vmexit",
            "file": "arch/x86/kvm/svm/nested.c"
        },
        "deprecated": false,
        "id": "CVE-2022-49559-1434f1af",
        "signature_version": "v1",
        "digest": {
            "length": 3760.0,
            "function_hash": "48360216004795862306026840548635417833"
        },
        "signature_type": "Function"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8d3a2aa0976f57320ba89baf9d57fb158dd0cd0d",
        "target": {
            "file": "arch/x86/kvm/svm/nested.c"
        },
        "deprecated": false,
        "id": "CVE-2022-49559-22dda6e3",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "163577042384396642970967562998904414579",
                "278522754751716740223788115417730916045",
                "212684716994281760823192573100073102212",
                "137196269922346906951826087921829325537"
            ]
        },
        "signature_type": "Line"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8d3a2aa0976f57320ba89baf9d57fb158dd0cd0d",
        "target": {
            "function": "nested_svm_vmexit",
            "file": "arch/x86/kvm/svm/nested.c"
        },
        "deprecated": false,
        "id": "CVE-2022-49559-230de764",
        "signature_version": "v1",
        "digest": {
            "length": 3695.0,
            "function_hash": "228714655774423446356021725033712024639"
        },
        "signature_type": "Function"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7de373c9b48229e428ecdb8fbde269c5a8617fd2",
        "target": {
            "function": "nested_svm_vmexit",
            "file": "arch/x86/kvm/svm/nested.c"
        },
        "deprecated": false,
        "id": "CVE-2022-49559-2f5f1e15",
        "signature_version": "v1",
        "digest": {
            "length": 3760.0,
            "function_hash": "48360216004795862306026840548635417833"
        },
        "signature_type": "Function"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8d3a2aa0976f57320ba89baf9d57fb158dd0cd0d",
        "target": {
            "function": "nested_vmx_vmexit",
            "file": "arch/x86/kvm/vmx/nested.c"
        },
        "deprecated": false,
        "id": "CVE-2022-49559-3ca58d40",
        "signature_version": "v1",
        "digest": {
            "length": 3185.0,
            "function_hash": "87803624259207729435988718814135727127"
        },
        "signature_type": "Function"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f476a59d5c86c02a79eef893c6da86735f2977ac",
        "target": {
            "file": "arch/x86/kvm/vmx/nested.c"
        },
        "deprecated": false,
        "id": "CVE-2022-49559-50e4b368",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "4473634757894001103206978700635413036",
                "182563573297900960344602238917154717570",
                "248150483448538252400960877186625932356",
                "209600698708882163058449305684211584675"
            ]
        },
        "signature_type": "Line"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@45846661d10422ce9e22da21f8277540b29eca22",
        "target": {
            "function": "nested_svm_vmexit",
            "file": "arch/x86/kvm/svm/nested.c"
        },
        "deprecated": false,
        "id": "CVE-2022-49559-664d1b37",
        "signature_version": "v1",
        "digest": {
            "length": 4155.0,
            "function_hash": "259358896947497200745336819650426938242"
        },
        "signature_type": "Function"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7de373c9b48229e428ecdb8fbde269c5a8617fd2",
        "target": {
            "function": "nested_vmx_vmexit",
            "file": "arch/x86/kvm/vmx/nested.c"
        },
        "deprecated": false,
        "id": "CVE-2022-49559-6ad8745f",
        "signature_version": "v1",
        "digest": {
            "length": 3185.0,
            "function_hash": "87803624259207729435988718814135727127"
        },
        "signature_type": "Function"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f476a59d5c86c02a79eef893c6da86735f2977ac",
        "target": {
            "file": "arch/x86/kvm/svm/nested.c"
        },
        "deprecated": false,
        "id": "CVE-2022-49559-754c807d",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "163577042384396642970967562998904414579",
                "278522754751716740223788115417730916045",
                "212684716994281760823192573100073102212",
                "137196269922346906951826087921829325537"
            ]
        },
        "signature_type": "Line"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7de373c9b48229e428ecdb8fbde269c5a8617fd2",
        "target": {
            "file": "arch/x86/kvm/vmx/nested.c"
        },
        "deprecated": false,
        "id": "CVE-2022-49559-81cf1540",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "4473634757894001103206978700635413036",
                "182563573297900960344602238917154717570",
                "248150483448538252400960877186625932356",
                "209600698708882163058449305684211584675"
            ]
        },
        "signature_type": "Line"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7de373c9b48229e428ecdb8fbde269c5a8617fd2",
        "target": {
            "file": "arch/x86/kvm/svm/nested.c"
        },
        "deprecated": false,
        "id": "CVE-2022-49559-8b39ca52",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "163577042384396642970967562998904414579",
                "278522754751716740223788115417730916045",
                "212684716994281760823192573100073102212",
                "137196269922346906951826087921829325537"
            ]
        },
        "signature_type": "Line"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@45846661d10422ce9e22da21f8277540b29eca22",
        "target": {
            "file": "arch/x86/kvm/svm/nested.c"
        },
        "deprecated": false,
        "id": "CVE-2022-49559-9272418b",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "76203315867755882670643215745155871735",
                "278522754751716740223788115417730916045",
                "212684716994281760823192573100073102212",
                "137196269922346906951826087921829325537"
            ]
        },
        "signature_type": "Line"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8d3a2aa0976f57320ba89baf9d57fb158dd0cd0d",
        "target": {
            "file": "arch/x86/kvm/vmx/nested.c"
        },
        "deprecated": false,
        "id": "CVE-2022-49559-ea7c46a0",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "4473634757894001103206978700635413036",
                "182563573297900960344602238917154717570",
                "248150483448538252400960877186625932356",
                "209600698708882163058449305684211584675"
            ]
        },
        "signature_type": "Line"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@45846661d10422ce9e22da21f8277540b29eca22",
        "target": {
            "function": "nested_vmx_vmexit",
            "file": "arch/x86/kvm/vmx/nested.c"
        },
        "deprecated": false,
        "id": "CVE-2022-49559-ef7ff5b7",
        "signature_version": "v1",
        "digest": {
            "length": 3034.0,
            "function_hash": "190256787887707728015279590847600477630"
        },
        "signature_type": "Function"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@45846661d10422ce9e22da21f8277540b29eca22",
        "target": {
            "file": "arch/x86/kvm/vmx/nested.c"
        },
        "deprecated": false,
        "id": "CVE-2022-49559-f5723658",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "4473634757894001103206978700635413036",
                "182563573297900960344602238917154717570",
                "248150483448538252400960877186625932356",
                "209600698708882163058449305684211584675"
            ]
        },
        "signature_type": "Line"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f476a59d5c86c02a79eef893c6da86735f2977ac",
        "target": {
            "function": "nested_vmx_vmexit",
            "file": "arch/x86/kvm/vmx/nested.c"
        },
        "deprecated": false,
        "id": "CVE-2022-49559-f626e525",
        "signature_version": "v1",
        "digest": {
            "length": 3185.0,
            "function_hash": "87803624259207729435988718814135727127"
        },
        "signature_type": "Function"
    }
]

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.13.0
Fixed
5.15.45
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
5.17.13
Type
ECOSYSTEM
Events
Introduced
5.18.0
Fixed
5.18.2