CVE-2022-50425: x86/fpu: Fix copy_xstate_to_uabi() to copy init states correctly
In the Linux kernel, the following vulnerability has been resolved:
x86/fpu: Fix copyxstatetouabi() to copy init states correctly
When an extended state component is not present in fpstate, but in init state, the function copies from initfpstate via copyfeature().
But, dynamic states are not present in initfpstate because of all-zeros init states. Then retrieving them from initfpstate will explode like this:
BUG: kernel NULL pointer dereference, address: 0000000000000000 ... RIP: 0010:memcpyerms+0x6/0x10 ? copyxstatetouabibuf+0x381/0x870 fpucopyguestfpstatetouabi+0x28/0x80 kvmarchvcpuioctl+0x14c/0x1460 [kvm] ? thiscpupreemptcheck+0x13/0x20 ? vmxvcpuput+0x2e/0x260 [kvmintel] kvmvcpuioctl+0xea/0x6b0 [kvm] ? kvmvcpuioctl+0xea/0x6b0 [kvm] ? fgetlight+0xd4/0x130 x64sysioctl+0xe3/0x910 ? debugsmpprocessorid+0x17/0x20 ? fpregsassertstateconsistent+0x27/0x50 dosyscall64+0x3f/0x90 entrySYSCALL64afterhwframe+0x63/0xcd
Adjust the 'mask' to zero out the userspace buffer for the features that are not available both from fpstate and from initfpstate.
The dynamic features depend on the compacted XSAVE format. Ensure it is enabled before reading XCOMPBV in initfpstate.
Affected Software
Remediation
Event History
Frequently Asked Questions
Which systems are most likely to be exposed?
Systems using KVM on x86 are the relevant exposure area, because the failing path is shown in KVM vCPU ioctl handling while copying guest FPU state to userspace. The issue involves dynamic extended-state features and the compacted XSAVE format.
What level of access is required to exploit this?
An attacker needs local access and low privileges (CVSS PR:L); no user interaction is required. Successful triggering can cause a kernel NULL pointer dereference and availability impact.
What should be done to remediate the issue?
Apply the available Linux kernel patch. The fix prevents copying unavailable extended-state features from init_fpstate by zeroing the corresponding userspace buffer mask, and ensures compacted XSAVE is enabled before handling dynamic features.