CVE-2022-49562

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86: Use __try_cmpxchg_user() to update guest PTE A/D bits

Use the recently introduced __try_cmpxchg_user() to update guest PTE A/D bits instead of mapping the PTE into kernel address space. The VM_PFNMAP path is broken as it assumes that vm_pgoff is the base pfn of the mapped VMA range, which is conceptually wrong as vm_pgoff is the offset relative to the file and has nothing to do with the pfn. The horrific hack worked for the original use case (backing guest memory with /dev/mem), but leads to accessing "random" pfns for pretty much any other VM_PFNMAP case.

This vulnerability is rated as Moderate impact because exploitation requires local access and specialized virtual machine configurations, constraining the blast radius primarily to a host denial of service. In standard Red Hat Enterprise Linux virtualization environments, hypervisors back guest memory using regular anonymous RAM or huge pages rather than arbitrary page-frame-mapped ranges. Consequently, triggering this flaw requires an uncommon setup or privileged configuration to cause invalid physical page frame references that crash the host.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.