CVE-2022-48991: mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths
In the Linux kernel, the following vulnerability has been resolved:
mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths
Any codepath that zaps page table entries must invoke MMU notifiers to ensure that secondary MMUs (like KVM) don't keep accessing pages which aren't mapped anymore. Secondary MMUs don't hold their own references to pages that are mirrored over, so failing to notify them can lead to page use-after-free.
I'm marking this as addressing an issue introduced in commit f3f0e1d2150b ("khugepaged: add support of collapse for tmpfs/shmem pages"), but most of the security impact of this only came in commit 27e1f8273113 ("khugepaged: enable collapse pmd for pte-mapped THP"), which actually omitted flushes for the removal of present PTEs, not just for the removal of empty page tables.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel mm/khugepagedto a version that resolves this vulnerability.Patch f3f0e1d2150b - Upgrade
Upgrade
Linux kernel mm/khugepagedto a version that resolves this vulnerability.Patch 27e1f8273113 - Configuration
Enable collapse pmd for pte-mapped THP in khugepaged (as part of the shmem/file collapse path changes) so that page table entry removal correctly invokes MMU notifiers.
mm/khugepaged collapse PTE-mapped THP = enable - Compensating control
Ensure that any codepath that zaps/removes page table entries in the khugepaged shmem/file collapse paths invokes MMU notifiers, so secondary MMUs (e.g., KVM) do not keep accessing pages after PTE removal/potential use-after-free.
Event History
Frequently Asked Questions
What is the severity of CVE-2022-48991?
The severity of CVE-2022-48991 is high, as it affects the Linux kernel's memory management functionality.
How do I fix CVE-2022-48991?
To fix CVE-2022-48991, upgrade to the latest stable version of the Linux kernel that contains the patch addressing this vulnerability.
What versions of the Linux kernel are affected by CVE-2022-48991?
CVE-2022-48991 affects multiple versions of the Linux kernel, specifically versions from 4.8 to 6.1-rc7.
Is CVE-2022-48991 related to virtualization technologies?
Yes, CVE-2022-48991 particularly concerns secondary MMUs like KVM, which could unintentionally access pages that have been invalidated.
What is the nature of the vulnerability in CVE-2022-48991?
CVE-2022-48991 involves the failure to invoke MMU notifiers when collapsing shared memory, leading to potential information leaks.