github - ghsa-p5hp-9793-2w9c

ghsa-p5hp-9793-2w9c

Vulnerability from github

Published

2024-07-16 12:30

Modified

2024-08-07 21:31

Severity ?

5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Details

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86: nSVM: fix potential NULL derefernce on nested migration

Turns out that due to review feedback and/or rebases I accidentally moved the call to nested_svm_load_cr3 to be too early, before the NPT is enabled, which is very wrong to do.

KVM can't even access guest memory at that point as nested NPT is needed for that, and of course it won't initialize the walk_mmu, which is main issue the patch was addressing.

Fix this for real.

Show details on source website

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2022-48793"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-07-16T12:15:04Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: nSVM: fix potential NULL derefernce on nested migration\n\nTurns out that due to review feedback and/or rebases\nI accidentally moved the call to nested_svm_load_cr3 to be too early,\nbefore the NPT is enabled, which is very wrong to do.\n\nKVM can\u0027t even access guest memory at that point as nested NPT\nis needed for that, and of course it won\u0027t initialize the walk_mmu,\nwhich is main issue the patch was addressing.\n\nFix this for real.",
  "id": "GHSA-p5hp-9793-2w9c",
  "modified": "2024-08-07T21:31:43Z",
  "published": "2024-07-16T12:30:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-48793"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/352193edda48e08e8824a7ece09aec830a603cfe"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/74b426bea4f7e3b081add2b88d4fba16d3af7ab6"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/e1779c2714c3023e4629825762bcbc43a3b943df"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

cve-2022-48793

Vulnerability from cvelistv5

Published

2024-07-16 11:43

Modified

2024-11-04 12:16

Severity ?

Summary

KVM: x86: nSVM: fix potential NULL derefernce on nested migration

References

▼	URL	Tags
	https://git.kernel.org/stable/c/74b426bea4f7e3b081add2b88d4fba16d3af7ab6
	https://git.kernel.org/stable/c/352193edda48e08e8824a7ece09aec830a603cfe
	https://git.kernel.org/stable/c/e1779c2714c3023e4629825762bcbc43a3b943df

Impacted products

▼	Vendor	Product
	Linux	Linux
	Linux	Linux

Show details on NVD website

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T15:25:01.559Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/74b426bea4f7e3b081add2b88d4fba16d3af7ab6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/352193edda48e08e8824a7ece09aec830a603cfe"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e1779c2714c3023e4629825762bcbc43a3b943df"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-48793",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:59:28.890983Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:15.345Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/svm/nested.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "74b426bea4f7",
              "status": "affected",
              "version": "232f75d3b4b5",
              "versionType": "git"
            },
            {
              "lessThan": "352193edda48",
              "status": "affected",
              "version": "232f75d3b4b5",
              "versionType": "git"
            },
            {
              "lessThan": "e1779c2714c3",
              "status": "affected",
              "version": "232f75d3b4b5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/svm/nested.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.13"
            },
            {
              "lessThan": "5.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.25",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.16.*",
              "status": "unaffected",
              "version": "5.16.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: nSVM: fix potential NULL derefernce on nested migration\n\nTurns out that due to review feedback and/or rebases\nI accidentally moved the call to nested_svm_load_cr3 to be too early,\nbefore the NPT is enabled, which is very wrong to do.\n\nKVM can\u0027t even access guest memory at that point as nested NPT\nis needed for that, and of course it won\u0027t initialize the walk_mmu,\nwhich is main issue the patch was addressing.\n\nFix this for real."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-04T12:16:40.349Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/74b426bea4f7e3b081add2b88d4fba16d3af7ab6"
        },
        {
          "url": "https://git.kernel.org/stable/c/352193edda48e08e8824a7ece09aec830a603cfe"
        },
        {
          "url": "https://git.kernel.org/stable/c/e1779c2714c3023e4629825762bcbc43a3b943df"
        }
      ],
      "title": "KVM: x86: nSVM: fix potential NULL derefernce on nested migration",
      "x_generator": {
        "engine": "bippy-9e1c9544281a"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-48793",
    "datePublished": "2024-07-16T11:43:48.749Z",
    "dateReserved": "2024-07-16T11:38:08.894Z",
    "dateUpdated": "2024-11-04T12:16:40.349Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Log in or create an account to share your comment.

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.