CVE-2022-1158: Use After Free
A flaw was found in KVM. When updating a guest's page table entry, vmpgoff was improperly used as the offset to get the page's pfn. As vaddr and vmpgoff are controllable by user-mode processes, this flaw allows unprivileged local users on the host to write outside the userspace region and potentially corrupt the kernel, resulting in a denial of service condition.
Other sources
Since both vaddr and vmpgoff are controllable by the user-mode process, writing may exceed the previously mapped guest memory space and trigger exceptions such as UAF.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-425.3.1.rt7.213.el8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-425.3.1.el8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-193.95.1.el8_2 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-193.95.1.rt13.146.el8_2 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-305.71.1.rt7.143.el8_4 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-305.71.1.el8_4 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-372.36.1.el8_6 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:5.14.0-162.6.1.el9_1 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:5.14.0-162.6.1.rt21.168.el9_1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:5.14.0-70.36.1.el9_0 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:5.14.0-70.36.1.rt21.108.el9_0 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.18 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2022-1158?
CVE-2022-1158 has been assigned a medium to high severity rating due to the potential for unprivileged local users to perform unauthorized write operations.
How do I fix CVE-2022-1158?
To remediate CVE-2022-1158, update to the appropriate kernel versions listed in the official advisory.
Which software is affected by CVE-2022-1158?
CVE-2022-1158 affects several kernel versions including those from Red Hat and Debian.
Is there a workaround for CVE-2022-1158?
There is no specific workaround detailed for CVE-2022-1158; patching the affected software is recommended.
What are the consequences of exploiting CVE-2022-1158?
Exploiting CVE-2022-1158 could allow unprivileged users to write outside their allocated memory space, potentially leading to data corruption or system instability.