CVE-2022-1158

A flaw was found in KVM. When updating a guests page table entry, vm_pgoff was improperly used as the offset to get the pages pfn. As vaddr and vm_pgoff are controllable by user-mode processes, this flaw allows unprivileged local users on the host to write outside the userspace region and potentially corrupt the kernel, resulting in a denial of service condition.

Weakness

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory “belongs” to the code that operates on the new pointer.

Affected Software

Potential Mitigations

References

• https://bugzilla.redhat.com/show_bug.cgi?id=2069793
• https://security.netapp.com/advisory/ntap-20230214-0003/
• https://www.openwall.com/lists/oss-security/2022/04/08/4
• https://bugzilla.redhat.com/show_bug.cgi?id=2069793
• https://security.netapp.com/advisory/ntap-20230214-0003/
• https://www.openwall.com/lists/oss-security/2022/04/08/4