CVE-2022-50851

A flaw was found in the Linux kernel's vhost_vdpa component. A local user or a malicious guest in a virtualized environment can trigger a kernel crash by attempting to unmap excessively large memory regions. This vulnerability, a type of memory corruption, leads to an invalid opcode and a host kernel panic, effectively causing a local denial of service against the host system.

A kernel crash can occur in the vhost_vdpa IOTLB unmap path when the guest or vIOMMU triggers an unmap of a very large IOVA range. Prior to the fix, vhost_vdpa_unmap could call into iommu_unmap or vdpa dma_unmap with a range that is larger than what is actually tracked and safe to unmap, which in some configurations triggers a BUG in the Intel IOMMU code path, resulting in an invalid opcode and host kernel panic. This yields a local denial of service against the host. The triggering scenario is typically a QEMU process using vhost_vdpa with an IOMMU aware device where the guest repeatedly maps and then unmaps large regions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.