Bug 2069736 (CVE-2022-2153)

Summary: CVE-2022-2153 kernel: KVM: NULL pointer dereference in kvm_irq_delivery_to_apic_fast()
Product: [Other] Security Response Reporter: Pedro Sampaio <psampaio>
Component: vulnerabilityAssignee: Nobody <nobody>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: acaringi, adscvr, airlied, alciregi, bhu, chwhite, crwood, ddepaula, dvlasenk, fpacheco, hdegoede, hkrzesin, hpa, jarod, jarodwilson, jburrell, jfaracco, jferlan, jforbes, jglisse, jlelli, joe.lawrence, jonathan, josef, jshortt, jstancek, jwboyer, jwyatt, kcarcia, kernel-maint, kernel-mgr, lgoncalv, linville, lzampier, masami256, mchehab, nmurray, ptalbert, qzhao, rvrbovsk, scweaver, steved, vkumar, walters, williams
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: kernel 5.18 Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the Linux kernel’s KVM when attempting to set a SynIC IRQ. This issue makes it possible for a misbehaving VMM to write to SYNIC/STIMER MSRs, causing a NULL pointer dereference. This flaw allows an unprivileged local attacker on the host to issue specific ioctl calls, causing a kernel oops condition that results in a denial of service.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 2067251, 2072549, 2074832, 2074835, 2099734, 2099735, 2099736, 2099737, 2099738    
Bug Blocks: 2069747    

Description Pedro Sampaio 2022-03-29 15:11:42 UTC
When KVM initialize a vCPU without create apic, the value of vcpu->arch.apic is NULL, then if we enter guest and let KVM call kvm_hv_process_stimers() in arch/x86/kvm/x86.c:9947, which doesn't check apic in the kernel. Process stimer will use apic finally so it will cause a null pointer dereference. This flaw allows a malicious user in a Local DOS condition.



Comment 5 Mauro Matteo Cascella 2022-06-21 15:23:03 UTC
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2099734]

Comment 8 Justin M. Forbes 2022-06-21 15:49:19 UTC
This was fixed for Fedora with the 5.16.19 stable kernel updates.

Comment 13 Mauro Matteo Cascella 2023-02-21 17:12:17 UTC
This issue was fixed upstream in version 5.18. The kernel packages as shipped in following Red Hat products were previously updated to a version that contains the fix via the following errata:

kernel in Red Hat Enterprise Linux 8

kernel-rt in Red Hat Enterprise Linux 8

kernel in Red Hat Enterprise Linux 9

kernel-rt in Red Hat Enterprise Linux 9