CVE-2022-50851
Description
A flaw was found in the Linux kernel's vhost_vdpa component. A local user or a malicious guest in a virtualized environment can trigger a kernel crash by attempting to unmap excessively large memory regions. This vulnerability, a type of memory corruption, leads to an invalid opcode and a host kernel panic, effectively causing a local denial of service against the host system.
Statement
A kernel crash can occur in the vhost_vdpa IOTLB unmap path when the guest or vIOMMU triggers an unmap of a very large IOVA range. Prior to the fix, vhost_vdpa_unmap could call into iommu_unmap or vdpa dma_unmap with a range that is larger than what is actually tracked and safe to unmap, which in some configurations triggers a BUG in the Intel IOMMU code path, resulting in an invalid opcode and host kernel panic. This yields a local denial of service against the host. The triggering scenario is typically a QEMU process using vhost_vdpa with an IOMMU aware device where the guest repeatedly maps and then unmaps large regions.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.6 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | Low | N/A | N/A |
| Integrity Impact | Low | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
Understanding the Weakness (CWE)
Integrity,Availability
Technical Impact: DoS: Crash, Exit, or Restart; Unexpected State
The data which were produced as a result of a function call could be in a bad state upon return. If the return value is not checked, then this bad data may be used in operations, possibly leading to a crash or other unintended behaviors.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
