In the Linux kernel, the following vulnerability has been resolved:
KVM: Don't null dereference ops->destroy
A KVM device cleanup happens in either of two callbacks: 1) destroy() which is called when the VM is being destroyed; 2) release() which is called when a device fd is closed.
Most KVM devices use 1) but Book3s's interrupt controller KVM devices (XICS, XIVE, XIVE-native) use 2) as they need to close and reopen during the machine execution. The error handling in kvmioctlcreate_device() assumes destroy() is always defined which leads to NULL dereference as discovered by Syzkaller.
This adds a checks for destroy!=NULL and adds a missing release().
This is not changing kvmdestroydevices() as devices with defined release() should have been removed from the KVM devices list by then.
[
{
"signature_type": "Function",
"digest": {
"function_hash": "319448531953289832463002057890298486062",
"length": 1129.0
},
"target": {
"file": "virt/kvm/kvm_main.c",
"function": "kvm_ioctl_create_device"
},
"signature_version": "v1",
"id": "CVE-2022-49568-36f761e3",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d4a5a79b780891c5cbdfdc6124d46fdf8d13dba1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "319448531953289832463002057890298486062",
"length": 1129.0
},
"target": {
"file": "virt/kvm/kvm_main.c",
"function": "kvm_ioctl_create_device"
},
"signature_version": "v1",
"id": "CVE-2022-49568-39048fe2",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3616776bc51cd3262bb1be60cc01c72e0a1959cf"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"110725184626704325139402773832838933119",
"176854761329777963062677628096838721987",
"278022076519475111619946111283532065177",
"302603905819142103242884048388706933193",
"24615322245916913942062148627001458457",
"42776649976232964070294417855827089109"
]
},
"target": {
"file": "virt/kvm/kvm_main.c"
},
"signature_version": "v1",
"id": "CVE-2022-49568-5caf9944",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3616776bc51cd3262bb1be60cc01c72e0a1959cf"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"110725184626704325139402773832838933119",
"176854761329777963062677628096838721987",
"278022076519475111619946111283532065177",
"302603905819142103242884048388706933193",
"24615322245916913942062148627001458457",
"42776649976232964070294417855827089109"
]
},
"target": {
"file": "virt/kvm/kvm_main.c"
},
"signature_version": "v1",
"id": "CVE-2022-49568-8bcbee05",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e91665fbbf3ccb268b268a7d71a6513538d813ac"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"110725184626704325139402773832838933119",
"176854761329777963062677628096838721987",
"278022076519475111619946111283532065177",
"302603905819142103242884048388706933193",
"24615322245916913942062148627001458457",
"42776649976232964070294417855827089109"
]
},
"target": {
"file": "virt/kvm/kvm_main.c"
},
"signature_version": "v1",
"id": "CVE-2022-49568-9650d8ad",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e8bc2427018826e02add7b0ed0fc625a60390ae5"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "319448531953289832463002057890298486062",
"length": 1129.0
},
"target": {
"file": "virt/kvm/kvm_main.c",
"function": "kvm_ioctl_create_device"
},
"signature_version": "v1",
"id": "CVE-2022-49568-ad000772",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e91665fbbf3ccb268b268a7d71a6513538d813ac"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "319448531953289832463002057890298486062",
"length": 1129.0
},
"target": {
"file": "virt/kvm/kvm_main.c",
"function": "kvm_ioctl_create_device"
},
"signature_version": "v1",
"id": "CVE-2022-49568-e68676da",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e8bc2427018826e02add7b0ed0fc625a60390ae5"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "249826464182458379426496434197405266031",
"length": 1123.0
},
"target": {
"file": "virt/kvm/kvm_main.c",
"function": "kvm_ioctl_create_device"
},
"signature_version": "v1",
"id": "CVE-2022-49568-f237a698",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@170465715a60cbb7876e6b961b21bd3225469da8"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"68979001374512882125894221665675702068",
"303954350076170134642788779479947948853",
"278022076519475111619946111283532065177",
"302603905819142103242884048388706933193",
"24615322245916913942062148627001458457",
"42776649976232964070294417855827089109"
]
},
"target": {
"file": "virt/kvm/kvm_main.c"
},
"signature_version": "v1",
"id": "CVE-2022-49568-fb489e78",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@170465715a60cbb7876e6b961b21bd3225469da8"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"110725184626704325139402773832838933119",
"176854761329777963062677628096838721987",
"278022076519475111619946111283532065177",
"302603905819142103242884048388706933193",
"24615322245916913942062148627001458457",
"42776649976232964070294417855827089109"
]
},
"target": {
"file": "virt/kvm/kvm_main.c"
},
"signature_version": "v1",
"id": "CVE-2022-49568-fe717a9b",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d4a5a79b780891c5cbdfdc6124d46fdf8d13dba1"
}
]