Bug 2072698 (CVE-2022-1263)

Summary:	CVE-2022-1263 kernel: KVM: NULL pointer dereference in kvm_dirty_ring_push in virt/kvm/dirty_ring.c
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	acaringi, adscvr, airlied, alciregi, bdettelb, bhu, chwhite, crwood, dvlasenk, hkrzesin, hpa, jarod, jarodwilson, jburrell, jfaracco, jforbes, jglisse, jlelli, joe.lawrence, jonathan, josef, jshortt, jstancek, jwboyer, jwyatt, kcarcia, kernel-maint, kernel-mgr, lgoncalv, linville, lzampier, masami256, mchehab, nmurray, ptalbert, qzhao, rvrbovsk, scweaver, steved, vkumar, walters, williams
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	kernel 5.18	Doc Type:	If docs needed, set a value
Doc Text:	A NULL pointer dereference issue was found in KVM when releasing a vCPU with dirty ring support enabled. This flaw allows an unprivileged local attacker on the host to issue specific ioctl calls, causing a kernel oops condition that results in a denial of service.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2061574, 2074832, 2074835, 2096875, 2096876, 2096877, 2096878, 2096881
Bug Blocks:	2072700, 2073418

Description Pedro Sampaio 2022-04-06 19:18:08 UTC

A null pointer dereference was found in the kvm module which can lead to denial of service. This flaw is in kvm_dirty_ring_push in virt/kvm/dirty_ring.c.

References:

https://www.openwall.com/lists/oss-security/2022/04/07/1

Comment 2 Mauro Matteo Cascella 2022-06-14 10:18:23 UTC

Upstream commit:
https://github.com/torvalds/linux/commit/5593473a1e6c743764b08e3b6071cb43b5cfa6c4

Comment 6 Mauro Matteo Cascella 2022-06-14 13:14:54 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2096875]

Comment 8 Justin M. Forbes 2022-06-14 14:33:12 UTC

This was fixed for Fedora with the 5.16.20 stable kernel updates.

Comment 16 Mauro Matteo Cascella 2023-05-04 13:47:22 UTC

This issue was fixed upstream in version 5.19. The kernel packages as shipped in the following Red Hat products were previously updated to a version that contains the fix via the following errata:

kernel in Red Hat Enterprise Linux 8
https://access.redhat.com/errata/RHSA-2022:7683

kernel-rt in Red Hat Enterprise Linux 8
https://access.redhat.com/errata/RHSA-2022:7444

kernel in Red Hat Enterprise Linux 9
https://access.redhat.com/errata/RHSA-2022:8267

kernel-rt in Red Hat Enterprise Linux 9
https://access.redhat.com/errata/RHSA-2022:7933