CVE-2022-50471

A logic error was found in the Linux kernel's Xen grant device driver in the VMA (Virtual Memory Area) splitting and grant mapping management. A local user in a Xen paravirtualized domain can trigger this issue by performing split munmap operations on grant mappings or remapping with MAP_FIXED, causing incorrect tracking of VMA boundaries and improper cleanup of grant references. This results in bad page mappings, general protection faults in the Xen hypervisor, and denial of service through domain crashes.

The gntdev driver manages memory mappings of pages granted by other Xen domains. The code maintained a single VMA pointer per grant mapping, but Linux can split VMAs when users partially unmap regions. When a mapping spanning two pages is split by unmapping one page, the driver loses track of the relationship between VMAs and grants. Additionally, the driver allowed remapping the same address range with MAP_FIXED, creating a scenario where grants are unmapped while marked as "being_removed," then remapped, then unmapped again—triggering Xen's protection against implicit unmapping of granted pages. The fix removes dependence on VMA tracking, uses atomic guards to prevent mapping reuse, and defers MMU notifier removal until all associated VMAs are closed. Triggering requires running as a Xen PV domain guest with the ability to manipulate gntdev mappings.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.