CVE-2022-2153: Null Pointer Dereference
A flaw was found in the Linux kernel’s KVM when attempting to set a SynIC IRQ. This issue makes it possible for a misbehaving VMM to write to SYNIC/STIMER MSRs, causing a NULL pointer dereference. This flaw allows an unprivileged local attacker on the host to issue specific ioctl calls, causing a kernel oops condition that results in a denial of service.
Other sources
When KVM initialize a vCPU without create apic, the value of vcpu->arch.apic is NULL, then if we enter guest and let KVM call kvmhvprocessstimers() in arch/x86/kvm/x86.c:9947, which doesn't check apic in the kernel. Process stimer will use apic finally so it will cause a null pointer dereference. This flaw allows a malicious user in a Local DOS condition.
References:
https://patchew.org/linux/20220325132140.25650-1-vkuznets@redhat.com/
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.18
Event History
Frequently Asked Questions
What is the severity of CVE-2022-2153?
CVE-2022-2153 has been assessed as medium severity due to the potential for a NULL pointer dereference by an unprivileged local attacker.
How do I fix CVE-2022-2153?
To fix CVE-2022-2153, upgrade to Linux kernel version 5.18 or apply available patches provided by your distribution.
Which Linux distributions are affected by CVE-2022-2153?
CVE-2022-2153 affects various Linux distributions including Red Hat Enterprise Linux, Fedora, and Debian Linux versions prior to their respective patches.
What can exploit CVE-2022-2153?
An unprivileged local attacker on the host can exploit CVE-2022-2153 by issuing specific ioctl calls to trigger the vulnerability.
What does CVE-2022-2153 impact?
CVE-2022-2153 impacts the Linux kernel's KVM functionality, particularly when handling SynIC IRQ settings.