Bug 2348031 (CVE-2022-49556)

Summary: CVE-2022-49556 kernel: KVM: SVM: Use kzalloc for sev ioctl interfaces to prevent kernel data leak
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: dfreiber, drow, jburrell, vkumar
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
A flaw was discovered in the Linux kernel’s KVM support for AMD SEV (Secure Encrypted Virtualization). In certain SEV ioctl interfaces, the code used an allocation sized according to user-supplied length, which could be larger than the actual data returned by the Secure Processor. This may result in returning uninitialized kernel memory to user space, potentially exposing sensitive information. Local users with permission to issue SEV ioctl calls may trigger this flaw. The vulnerability has been fixed by switching to zero-initialized allocations and correctly sizing buffers.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2025-02-26 03:15:13 UTC 
In the Linux kernel, the following vulnerability has been resolved:

KVM: SVM: Use kzalloc for sev ioctl interfaces to prevent kernel data leak

For some sev ioctl interfaces, the length parameter that is passed maybe
less than or equal to SEV_FW_BLOB_MAX_SIZE, but larger than the data
that PSP firmware returns. In this case, kmalloc will allocate memory
that is the size of the input rather than the size of the data.
Since PSP firmware doesn't fully overwrite the allocated buffer, these
sev ioctl interface may return uninitialized kernel slab memory.
Comment 1 Avinash Hanwate 2025-02-26 21:29:19 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025022617-CVE-2022-49556-9870@gregkh/T