CVE-2011-4622: Null Pointer Dereference
Last updated 24 July 2024
Other sources
The createpittimer function in arch/x86/kvm/i8254.c in KVM 83, and possibly other versions, does not properly handle when Programmable Interval Timer (PIT) interrupt requests (IRQs) when a virtual interrupt controller (irqchip) is not available, which allows local users to cause a denial of service (NULL pointer dereference) by starting a timer.
— Launchpad
User space may create the PIT and forgets about setting up the irqchips. In that case, firing PIT IRQs will crash the host:
BUG: unable to handle kernel NULL pointer dereference at 0000000000000128 IP: [<ffffffffa10f6280>] kvmsetirq+0x30/0x170 [kvm] ... Call Trace: [<ffffffffa11228c1>] pitdowork+0x51/0xd0 [kvm] [<ffffffff81071431>] processonework+0x111/0x4d0 [<ffffffff81071bb2>] workerthread+0x152/0x340 [<ffffffff81075c8e>] kthread+0x7e/0x90 [<ffffffff815a4474>] kernelthreadhelper+0x4/0x10
Reference: http://permalink.gmane.org/gmane.comp.emulators.kvm.devel/83564
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2011-4622?
CVE-2011-4622 is classified as a moderate severity vulnerability due to its potential impact on local user security within the KVM environment.
How do I fix CVE-2011-4622?
To mitigate CVE-2011-4622, it's recommended to update the KVM package to the latest stable version provided by your distribution.
What systems are affected by CVE-2011-4622?
CVE-2011-4622 affects KVM version 83 and possibly earlier versions on systems using Debian and Red Hat.
Can CVE-2011-4622 be exploited remotely?
CVE-2011-4622 cannot be exploited remotely as it specifically requires local user access to the system.
Is there a workaround for CVE-2011-4622?
Currently, there are no effective workarounds for CVE-2011-4622, and the best mitigation is through an updated KVM version.