In the Linux kernel, the following vulnerability has been resolved:
KVM: Initialize gfn_to_pfn_cache locks in dedicated helper
Move the gfn_to_pfn_cache lock initialization to another helper and
call the new helper during VM/vCPU creation. There are race
conditions possible due to kvm_gfn_to_pfn_cache_init()'s
ability to re-initialize the cache's locks.
For example: a race between ioctl(KVM_XEN_HVM_EVTCHN_SEND) and
kvm_gfn_to_pfn_cache_init() leads to a corrupted shinfo gpc lock.
(thread 1) | (thread 2)
|
kvm_xen_set_evtchn_fast |
read_lock_irqsave(&gpc->lock, ...) |
| kvm_gfn_to_pfn_cache_init
| rwlock_init(&gpc->lock)
read_unlock_irqrestore(&gpc->lock, ...) |
Rename "cache_init" and "cache_destroy" to activate+deactivate to
avoid implying that the cache really is destroyed/freed.
Note, there more races in the newly named kvm_gpc_activate() that will
be addressed separately.
[sean: call out that this is a bug fix]
References
Configurations
Configuration 1 (hide)
|
History
10 Nov 2025, 21:19
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-362 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.7 |
| CPE | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:* |
|
| References | () https://git.kernel.org/stable/c/52491a38b2c2411f3f0229dc6ad610349c704a41 - Patch | |
| References | () https://git.kernel.org/stable/c/61242001d6c9c253df7645dab090842d8da08764 - Patch | |
| First Time |
Linux linux Kernel
Linux |
Information
Published : 2025-05-01 15:16
Updated : 2025-11-10 21:19
NVD link : CVE-2022-49884
Mitre link : CVE-2022-49884
CVE.ORG link : CVE-2022-49884
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')