From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1F2351A4F2D for ; Wed, 26 Feb 2025 01:58:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740535134; cv=none; b=ZnEXAO3zohB2U99VgQv4gSrXmBJNwYsuShZ1HR5xKjIK4ndVgzqV8IF/YVBXrtaLV/nM3Q8EA4RxBoA4aEg9ew1vu7lPAEASDynOB8kj7ZHP26mxOQ92LAB34FHp0GagLwLF/8IrMXTxsxCTeyZM+jps7bu3kA2smrMP73ZUE0w= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740535134; c=relaxed/simple; bh=ApbSbr1Dxk+xKJPMa/1BEfZKdpcAq6yG0txWzMg5t0I=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=cwV0p3Ds/aA9vjl4VyZAip3qhInauHLsdaHPhsHklfiP7GqrCg3JWFu8a27Tr++3ete1XCKQbZQdXnva9Lcas2rAswlEqOUlsYHJljI9K9+AIvoOnDsRSv0nZjhZRvmHokh+JDQfSYC6pQIGNPo+A/eMmYiMnOKfDqfEwpwF/uw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=znT08mc1; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="znT08mc1" Received: by smtp.kernel.org (Postfix) with ESMTPSA id E6750C4CEDD; Wed, 26 Feb 2025 01:58:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1740535134; bh=ApbSbr1Dxk+xKJPMa/1BEfZKdpcAq6yG0txWzMg5t0I=; h=From:To:Cc:Subject:Date:Reply-to:From; b=znT08mc1xA5u5MDefVXbMI5mVfwbTPKSDH0UifWRpLAaL4nR6jPI5P4v6frQb9J+w Mh3GM6W5mnbecyIEuJgszUb3r4sFFo9NwAotFqbwI/leBPdI1vS4O6CwrTCX/ugOjT Od83f2COWDyxlWnk3rOzoFsjetfHGebS2qeVQu3Q= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2022-49154: KVM: SVM: fix panic on out-of-bounds guest IRQ Date: Wed, 26 Feb 2025 02:55:59 +0100 Message-ID: <2025022609-CVE-2022-49154-5fd5@gregkh> X-Mailer: git-send-email 2.48.1 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=3999; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=ApbSbr1Dxk+xKJPMa/1BEfZKdpcAq6yG0txWzMg5t0I=; b=owGbwMvMwCRo6H6F97bub03G02pJDOn7Shy/TD7+PX6CeN8XD5dW4zt+Vn8d7ztFGnjqBc5km iaQIGzREcvCIMjEICumyPJlG8/R/RWHFL0MbU/DzGFlAhnCwMUpABPhi2WY7/oiVmJZ5r78nYlP T4TXzdFYtcB3FsN8x12Tts7+NiH+vuKT2K03yybuThbtBwA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit Description =========== In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: fix panic on out-of-bounds guest IRQ As guest_irq is coming from KVM_IRQFD API call, it may trigger crash in svm_update_pi_irte() due to out-of-bounds: crash> bt PID: 22218 TASK: ffff951a6ad74980 CPU: 73 COMMAND: "vcpu8" #0 [ffffb1ba6707fa40] machine_kexec at ffffffff8565b397 #1 [ffffb1ba6707fa90] __crash_kexec at ffffffff85788a6d #2 [ffffb1ba6707fb58] crash_kexec at ffffffff8578995d #3 [ffffb1ba6707fb70] oops_end at ffffffff85623c0d #4 [ffffb1ba6707fb90] no_context at ffffffff856692c9 #5 [ffffb1ba6707fbf8] exc_page_fault at ffffffff85f95b51 #6 [ffffb1ba6707fc50] asm_exc_page_fault at ffffffff86000ace [exception RIP: svm_update_pi_irte+227] RIP: ffffffffc0761b53 RSP: ffffb1ba6707fd08 RFLAGS: 00010086 RAX: ffffb1ba6707fd78 RBX: ffffb1ba66d91000 RCX: 0000000000000001 RDX: 00003c803f63f1c0 RSI: 000000000000019a RDI: ffffb1ba66db2ab8 RBP: 000000000000019a R8: 0000000000000040 R9: ffff94ca41b82200 R10: ffffffffffffffcf R11: 0000000000000001 R12: 0000000000000001 R13: 0000000000000001 R14: ffffffffffffffcf R15: 000000000000005f ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 #7 [ffffb1ba6707fdb8] kvm_irq_routing_update at ffffffffc09f19a1 [kvm] #8 [ffffb1ba6707fde0] kvm_set_irq_routing at ffffffffc09f2133 [kvm] #9 [ffffb1ba6707fe18] kvm_vm_ioctl at ffffffffc09ef544 [kvm] RIP: 00007f143c36488b RSP: 00007f143a4e04b8 RFLAGS: 00000246 RAX: ffffffffffffffda RBX: 00007f05780041d0 RCX: 00007f143c36488b RDX: 00007f05780041d0 RSI: 000000004008ae6a RDI: 0000000000000020 RBP: 00000000000004e8 R8: 0000000000000008 R9: 00007f05780041e0 R10: 00007f0578004560 R11: 0000000000000246 R12: 00000000000004e0 R13: 000000000000001a R14: 00007f1424001c60 R15: 00007f0578003bc0 ORIG_RAX: 0000000000000010 CS: 0033 SS: 002b Vmx have been fix this in commit 3a8b0677fc61 (KVM: VMX: Do not BUG() on out-of-bounds guest IRQ), so we can just copy source from that to fix this. The Linux kernel CVE team has assigned CVE-2022-49154 to this issue. Affected and fixed versions =========================== Fixed in 5.10.110 with commit 0fb470eb48892e131d10aa3be6915239e65758f3 Fixed in 5.15.33 with commit 3fa2d747960521a646fc1aad7aea82e95e139a68 Fixed in 5.16.19 with commit e4d153d53d9648513481eb4ef8c212e7f1f8173d Fixed in 5.17.2 with commit a6ffdebfb6a9c2ffeed902b544b96fe67498210e Fixed in 5.18 with commit a80ced6ea514000d34bf1239d47553de0d1ee89e Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2022-49154 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: arch/x86/kvm/svm/avic.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/0fb470eb48892e131d10aa3be6915239e65758f3 https://git.kernel.org/stable/c/3fa2d747960521a646fc1aad7aea82e95e139a68 https://git.kernel.org/stable/c/e4d153d53d9648513481eb4ef8c212e7f1f8173d https://git.kernel.org/stable/c/a6ffdebfb6a9c2ffeed902b544b96fe67498210e https://git.kernel.org/stable/c/a80ced6ea514000d34bf1239d47553de0d1ee89e