In the Linux kernel, the following vulnerability has been resolved:
KVM: VMX: Do all initialization before exposing /dev/kvm to userspace
Call kvminit() only after all setup is complete, as kvminit() exposes /dev/kvm to userspace and thus allows userspace to create VMs (and call other ioctls). E.g. KVM will encounter a NULL pointer when attempting to add a vCPU to the per-CPU loadedvmcssoncpu list if userspace is able to create a VM before vmxinit() configures said list.
BUG: kernel NULL pointer dereference, address: 0000000000000008 #PF: supervisor write access in kernel mode #PF: errorcode(0x0002) - not-present page PGD 0 P4D 0 Oops: 0002 [#1] SMP CPU: 6 PID: 1143 Comm: stable Not tainted 6.0.0-rc7+ #988 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:vmxvcpuloadvmcs+0x68/0x230 [kvmintel] <TASK> vmxvcpuload+0x16/0x60 [kvmintel] kvmarchvcpuload+0x32/0x1f0 [kvm] vcpuload+0x2f/0x40 [kvm] kvmarchvcpucreate+0x231/0x310 [kvm] kvmvmioctl+0x79f/0xe10 [kvm] ? handlemm_fault+0xb1/0x220 _x64sysioctl+0x80/0xb0 dosyscall64+0x2b/0x50 entrySYSCALL64afterhwframe+0x46/0xb0 RIP: 0033:0x7f5a6b05743b </TASK> Modules linked in: vhostnet vhost vhostiotlb tap kvmintel(+) kvm irqbypass
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49932.json"
}"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-49932.json"
[
{
"signature_version": "v1",
"target": {
"file": "arch/x86/kvm/vmx/vmx.c",
"function": "vmx_init"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e32b120071ea114efc0b4ddd439547750b85f618",
"deprecated": false,
"digest": {
"function_hash": "11254662052097902555573327362678734226",
"length": 738.0
},
"id": "CVE-2022-49932-0c8218fc",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"file": "arch/x86/kvm/vmx/vmx.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e136e969d268b9b89329c816c002e53f60e82985",
"deprecated": false,
"digest": {
"line_hashes": [
"115996693027527703161209995272407446746",
"14550680395678512405177380785393626717",
"86871228489331598301069549059355019554",
"298024347189193054883938741195701173124",
"115740588042314139570185062939003964004",
"218821192125631422474231809439800293882",
"152883657584681249956146586040467204710",
"272291187339715379464953792196681251832",
"159470554143755989398597769111807888360",
"163270749745217957651757957238788982566",
"114893467342963719414623619976468612223",
"310616348715419517919429755700106603357",
"244910314280635695054171391718533429042",
"55713185179808215092771399416746315448",
"266246399651923192598470322505629048273",
"133696775233066978453248642470420862732",
"156160939644141877417609168138055028415",
"193498591572543373795536658625764257588",
"304583734931260107466911367234922552333",
"197913230399585141708525101991839571423",
"171169441784924822490974757843878134508",
"176716047285811969252725167472037629902",
"21261372860540432895647686793683231578",
"197068326825099445766349761778889968561",
"279027862162108087736385054822239833216",
"259841412630124736697354392022469624779",
"112379517267515182419001272451525385377"
],
"threshold": 0.9
},
"id": "CVE-2022-49932-376b83da",
"signature_type": "Line"
},
{
"signature_version": "v1",
"target": {
"file": "arch/x86/kvm/vmx/vmx.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e28533c08023c4b319b7f2cd77f3f7c9204eb517",
"deprecated": false,
"digest": {
"line_hashes": [
"115996693027527703161209995272407446746",
"14550680395678512405177380785393626717",
"86871228489331598301069549059355019554",
"298024347189193054883938741195701173124",
"115740588042314139570185062939003964004",
"218821192125631422474231809439800293882",
"152883657584681249956146586040467204710",
"272291187339715379464953792196681251832",
"159470554143755989398597769111807888360",
"163270749745217957651757957238788982566",
"114893467342963719414623619976468612223",
"310616348715419517919429755700106603357",
"244910314280635695054171391718533429042",
"55713185179808215092771399416746315448",
"266246399651923192598470322505629048273",
"133696775233066978453248642470420862732",
"156160939644141877417609168138055028415",
"193498591572543373795536658625764257588",
"304583734931260107466911367234922552333",
"197913230399585141708525101991839571423",
"171169441784924822490974757843878134508",
"176716047285811969252725167472037629902",
"21261372860540432895647686793683231578",
"197068326825099445766349761778889968561",
"279027862162108087736385054822239833216",
"259841412630124736697354392022469624779",
"112379517267515182419001272451525385377"
],
"threshold": 0.9
},
"id": "CVE-2022-49932-530b998b",
"signature_type": "Line"
},
{
"signature_version": "v1",
"target": {
"file": "arch/x86/kvm/vmx/vmx.c",
"function": "vmx_exit"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e28533c08023c4b319b7f2cd77f3f7c9204eb517",
"deprecated": false,
"digest": {
"function_hash": "6501742686016037084963300049278439751",
"length": 213.0
},
"id": "CVE-2022-49932-575e8e66",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"file": "arch/x86/kvm/vmx/vmx.c",
"function": "vmx_exit"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e136e969d268b9b89329c816c002e53f60e82985",
"deprecated": false,
"digest": {
"function_hash": "6501742686016037084963300049278439751",
"length": 213.0
},
"id": "CVE-2022-49932-867bc267",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"file": "arch/x86/kvm/vmx/vmx.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e32b120071ea114efc0b4ddd439547750b85f618",
"deprecated": false,
"digest": {
"line_hashes": [
"115996693027527703161209995272407446746",
"14550680395678512405177380785393626717",
"86871228489331598301069549059355019554",
"298024347189193054883938741195701173124",
"115740588042314139570185062939003964004",
"218821192125631422474231809439800293882",
"152883657584681249956146586040467204710",
"272291187339715379464953792196681251832",
"159470554143755989398597769111807888360",
"163270749745217957651757957238788982566",
"114893467342963719414623619976468612223",
"310616348715419517919429755700106603357",
"244910314280635695054171391718533429042",
"55713185179808215092771399416746315448",
"266246399651923192598470322505629048273",
"133696775233066978453248642470420862732",
"156160939644141877417609168138055028415",
"193498591572543373795536658625764257588",
"304583734931260107466911367234922552333",
"197913230399585141708525101991839571423",
"171169441784924822490974757843878134508",
"176716047285811969252725167472037629902",
"21261372860540432895647686793683231578",
"197068326825099445766349761778889968561",
"279027862162108087736385054822239833216",
"259841412630124736697354392022469624779",
"112379517267515182419001272451525385377"
],
"threshold": 0.9
},
"id": "CVE-2022-49932-8b1f996b",
"signature_type": "Line"
},
{
"signature_version": "v1",
"target": {
"file": "arch/x86/kvm/vmx/vmx.c",
"function": "vmx_init"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e136e969d268b9b89329c816c002e53f60e82985",
"deprecated": false,
"digest": {
"function_hash": "297420345795443148171792106578918403527",
"length": 1321.0
},
"id": "CVE-2022-49932-bda04a97",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"file": "arch/x86/kvm/vmx/vmx.c",
"function": "vmx_init"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e28533c08023c4b319b7f2cd77f3f7c9204eb517",
"deprecated": false,
"digest": {
"function_hash": "280378136003898746111882577045880956259",
"length": 1315.0
},
"id": "CVE-2022-49932-e57e3d14",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"file": "arch/x86/kvm/vmx/vmx.c",
"function": "vmx_exit"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e32b120071ea114efc0b4ddd439547750b85f618",
"deprecated": false,
"digest": {
"function_hash": "6501742686016037084963300049278439751",
"length": 213.0
},
"id": "CVE-2022-49932-e9deba75",
"signature_type": "Function"
}
]