PT-2022-2585 · Linux+8 · Linux Kernel+8
Gaoning Pan
+2
·
Published
2022-04-02
·
Updated
2023-08-14
·
CVE-2022-1158
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux Kernel versions prior to the fixed version
Description
A flaw was found in the Kernel-based Virtual Machine (KVM) subsystem of the Linux kernel. The issue is related to the
get user pages fast() function and involves writing data outside the buffer in memory. This flaw allows unprivileged local users on the host to write outside the userspace region and potentially corrupt the kernel, resulting in a denial of service condition. The vaddr and vm pgoff variables are controllable by user-mode processes, which can be exploited to cause the issue.Recommendations
For Linux Kernel versions prior to the fixed version, consider updating to a newer version that contains a fix for this issue. As a temporary workaround, restrict access to the KVM subsystem to minimize the risk of exploitation. Avoid using the
get user pages fast() function until a patch is available.Exploit
Fix
DoS
Memory Corruption
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Centos
Linux Kernel
Linuxmint
Red Hat
Red Os
Suse
Ubuntu