CVE-2022-48943 (GCVE-0-2022-48943)
Vulnerability from cvelistv5
Published
2024-08-22 03:30
Modified
2025-05-04 08:26
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: make apf token non-zero to fix bug In current async pagefault logic, when a page is ready, KVM relies on kvm_arch_can_dequeue_async_page_present() to determine whether to deliver a READY event to the Guest. This function test token value of struct kvm_vcpu_pv_apf_data, which must be reset to zero by Guest kernel when a READY event is finished by Guest. If value is zero meaning that a READY event is done, so the KVM can deliver another. But the kvm_arch_setup_async_pf() may produce a valid token with zero value, which is confused with previous mention and may lead the loss of this READY event. This bug may cause task blocked forever in Guest: INFO: task stress:7532 blocked for more than 1254 seconds. Not tainted 5.10.0 #16 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:stress state:D stack: 0 pid: 7532 ppid: 1409 flags:0x00000080 Call Trace: __schedule+0x1e7/0x650 schedule+0x46/0xb0 kvm_async_pf_task_wait_schedule+0xad/0xe0 ? exit_to_user_mode_prepare+0x60/0x70 __kvm_handle_async_pf+0x4f/0xb0 ? asm_exc_page_fault+0x8/0x30 exc_page_fault+0x6f/0x110 ? asm_exc_page_fault+0x8/0x30 asm_exc_page_fault+0x1e/0x30 RIP: 0033:0x402d00 RSP: 002b:00007ffd31912500 EFLAGS: 00010206 RAX: 0000000000071000 RBX: ffffffffffffffff RCX: 00000000021a32b0 RDX: 000000000007d011 RSI: 000000000007d000 RDI: 00000000021262b0 RBP: 00000000021262b0 R08: 0000000000000003 R09: 0000000000000086 R10: 00000000000000eb R11: 00007fefbdf2baa0 R12: 0000000000000000 R13: 0000000000000002 R14: 000000000007d000 R15: 0000000000001000
References
Impacted products
Vendor Product Version
Linux Linux Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-48943",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:33:08.943998Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T17:33:10.679Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/mmu/mmu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "72fdfc75d4217b32363cc80def3de2cb3fef3f02",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "4c3644b6c96c5daa5149e5abddc07234eea47c7c",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "62040f5cd7d937de547836e747b6aa8212fec573",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "6f3c1fc53d86d580d8d6d749c4af23705e4f6f79",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/mmu/mmu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.26",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.16.*",
              "status": "unaffected",
              "version": "5.16.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.103",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86/mmu: make apf token non-zero to fix bug\n\nIn current async pagefault logic, when a page is ready, KVM relies on\nkvm_arch_can_dequeue_async_page_present() to determine whether to deliver\na READY event to the Guest. This function test token value of struct\nkvm_vcpu_pv_apf_data, which must be reset to zero by Guest kernel when a\nREADY event is finished by Guest. If value is zero meaning that a READY\nevent is done, so the KVM can deliver another.\nBut the kvm_arch_setup_async_pf() may produce a valid token with zero\nvalue, which is confused with previous mention and may lead the loss of\nthis READY event.\n\nThis bug may cause task blocked forever in Guest:\n INFO: task stress:7532 blocked for more than 1254 seconds.\n       Not tainted 5.10.0 #16\n \"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\n task:stress          state:D stack:    0 pid: 7532 ppid:  1409\n flags:0x00000080\n Call Trace:\n  __schedule+0x1e7/0x650\n  schedule+0x46/0xb0\n  kvm_async_pf_task_wait_schedule+0xad/0xe0\n  ? exit_to_user_mode_prepare+0x60/0x70\n  __kvm_handle_async_pf+0x4f/0xb0\n  ? asm_exc_page_fault+0x8/0x30\n  exc_page_fault+0x6f/0x110\n  ? asm_exc_page_fault+0x8/0x30\n  asm_exc_page_fault+0x1e/0x30\n RIP: 0033:0x402d00\n RSP: 002b:00007ffd31912500 EFLAGS: 00010206\n RAX: 0000000000071000 RBX: ffffffffffffffff RCX: 00000000021a32b0\n RDX: 000000000007d011 RSI: 000000000007d000 RDI: 00000000021262b0\n RBP: 00000000021262b0 R08: 0000000000000003 R09: 0000000000000086\n R10: 00000000000000eb R11: 00007fefbdf2baa0 R12: 0000000000000000\n R13: 0000000000000002 R14: 000000000007d000 R15: 0000000000001000"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T08:26:37.550Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/72fdfc75d4217b32363cc80def3de2cb3fef3f02"
        },
        {
          "url": "https://git.kernel.org/stable/c/4c3644b6c96c5daa5149e5abddc07234eea47c7c"
        },
        {
          "url": "https://git.kernel.org/stable/c/62040f5cd7d937de547836e747b6aa8212fec573"
        },
        {
          "url": "https://git.kernel.org/stable/c/6f3c1fc53d86d580d8d6d749c4af23705e4f6f79"
        }
      ],
      "title": "KVM: x86/mmu: make apf token non-zero to fix bug",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-48943",
    "datePublished": "2024-08-22T03:30:14.027Z",
    "dateReserved": "2024-08-22T01:27:53.623Z",
    "dateUpdated": "2025-05-04T08:26:37.550Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-48943\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-08-22T04:15:19.027\",\"lastModified\":\"2024-08-22T18:27:42.807\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nKVM: x86/mmu: make apf token non-zero to fix bug\\n\\nIn current async pagefault logic, when a page is ready, KVM relies on\\nkvm_arch_can_dequeue_async_page_present() to determine whether to deliver\\na READY event to the Guest. This function test token value of struct\\nkvm_vcpu_pv_apf_data, which must be reset to zero by Guest kernel when a\\nREADY event is finished by Guest. If value is zero meaning that a READY\\nevent is done, so the KVM can deliver another.\\nBut the kvm_arch_setup_async_pf() may produce a valid token with zero\\nvalue, which is confused with previous mention and may lead the loss of\\nthis READY event.\\n\\nThis bug may cause task blocked forever in Guest:\\n INFO: task stress:7532 blocked for more than 1254 seconds.\\n       Not tainted 5.10.0 #16\\n \\\"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\\\" disables this message.\\n task:stress          state:D stack:    0 pid: 7532 ppid:  1409\\n flags:0x00000080\\n Call Trace:\\n  __schedule+0x1e7/0x650\\n  schedule+0x46/0xb0\\n  kvm_async_pf_task_wait_schedule+0xad/0xe0\\n  ? exit_to_user_mode_prepare+0x60/0x70\\n  __kvm_handle_async_pf+0x4f/0xb0\\n  ? asm_exc_page_fault+0x8/0x30\\n  exc_page_fault+0x6f/0x110\\n  ? asm_exc_page_fault+0x8/0x30\\n  asm_exc_page_fault+0x1e/0x30\\n RIP: 0033:0x402d00\\n RSP: 002b:00007ffd31912500 EFLAGS: 00010206\\n RAX: 0000000000071000 RBX: ffffffffffffffff RCX: 00000000021a32b0\\n RDX: 000000000007d011 RSI: 000000000007d000 RDI: 00000000021262b0\\n RBP: 00000000021262b0 R08: 0000000000000003 R09: 0000000000000086\\n R10: 00000000000000eb R11: 00007fefbdf2baa0 R12: 0000000000000000\\n R13: 0000000000000002 R14: 000000000007d000 R15: 0000000000001000\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: KVM: x86/mmu: haga que el token apf sea distinto de cero para corregir el error En la l\u00f3gica de error de p\u00e1gina as\u00edncrona actual, cuando una p\u00e1gina est\u00e1 lista, KVM se basa en kvm_arch_can_dequeue_async_page_present() para determinar si se debe entregar un evento LISTO para el Invitado. Esta funci\u00f3n prueba el valor del token de la estructura kvm_vcpu_pv_apf_data, que el kernel invitado debe restablecer a cero cuando el invitado finaliza un evento READY. Si el valor es cero, significa que se realiz\u00f3 un evento READY, por lo que el KVM puede entregar otro. Pero kvm_arch_setup_async_pf() puede producir un token v\u00e1lido con valor cero, lo que se confunde con la menci\u00f3n anterior y puede provocar la p\u00e9rdida de este evento READY. Este error puede causar que la tarea se bloquee para siempre en Guest: INFORMACI\u00d3N: tarea de estr\u00e9s:7532 bloqueada durante m\u00e1s de 1254 segundos. Not tainted 5.10.0 #16 \\\"echo 0 \u0026gt; /proc/sys/kernel/hung_task_timeout_secs\\\" desactiva este mensaje. tarea:estr\u00e9s estado:D pila: 0 pid: 7532 ppid: 1409 banderas:0x00000080 Seguimiento de llamadas: __schedule+0x1e7/0x650 Schedule+0x46/0xb0 kvm_async_pf_task_wait_schedule+0xad/0xe0 ? exit_to_user_mode_prepare+0x60/0x70 __kvm_handle_async_pf+0x4f/0xb0 ? asm_exc_page_fault+0x8/0x30 exc_page_fault+0x6f/0x110? asm_exc_page_fault+0x8/0x30 asm_exc_page_fault+0x1e/0x30 RIP: 0033:0x402d00 RSP: 002b:00007ffd31912500 EFLAGS: 00010206 RAX: 0000000000071000 RBX: ffffffff RCX: 00000000021a32b0 RDX: 000000000007d011 RSI: 000000000007d000 RDI: 00000000021262b0 RBP: 00000000021262b0 R08: 03 R09: 0000000000000086 R10: 000000000000000000EB R11: 00007FEFBDF2BAA0 R12: 00000000000000000000 R13: 0000000000000002 R14: 000000000007D000 R15: 00000000001000\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"5.10.103\",\"matchCriteriaId\":\"7E2EF203-0F7F-41A9-9684-671AAD1D37A1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.26\",\"matchCriteriaId\":\"9AB342AE-A62E-4947-A6EA-511453062B2B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"5.16.12\",\"matchCriteriaId\":\"C76BAB21-7F23-4AD8-A25F-CA7B262A2698\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/4c3644b6c96c5daa5149e5abddc07234eea47c7c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/62040f5cd7d937de547836e747b6aa8212fec573\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6f3c1fc53d86d580d8d6d749c4af23705e4f6f79\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/72fdfc75d4217b32363cc80def3de2cb3fef3f02\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-48943\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T15:33:08.943998Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:15.638Z\"}}], \"cna\": {\"title\": \"KVM: x86/mmu: make apf token non-zero to fix bug\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"1da177e4c3f4\", \"lessThan\": \"72fdfc75d421\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1da177e4c3f4\", \"lessThan\": \"4c3644b6c96c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1da177e4c3f4\", \"lessThan\": \"62040f5cd7d9\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1da177e4c3f4\", \"lessThan\": \"6f3c1fc53d86\", \"versionType\": \"git\"}], \"programFiles\": [\"arch/x86/kvm/mmu/mmu.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"5.10.103\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.26\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"5.16.12\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"5.16.*\"}, {\"status\": \"unaffected\", \"version\": \"5.17\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"arch/x86/kvm/mmu/mmu.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/72fdfc75d4217b32363cc80def3de2cb3fef3f02\"}, {\"url\": \"https://git.kernel.org/stable/c/4c3644b6c96c5daa5149e5abddc07234eea47c7c\"}, {\"url\": \"https://git.kernel.org/stable/c/62040f5cd7d937de547836e747b6aa8212fec573\"}, {\"url\": \"https://git.kernel.org/stable/c/6f3c1fc53d86d580d8d6d749c4af23705e4f6f79\"}], \"x_generator\": {\"engine\": \"bippy-c9c4e1df01b2\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nKVM: x86/mmu: make apf token non-zero to fix bug\\n\\nIn current async pagefault logic, when a page is ready, KVM relies on\\nkvm_arch_can_dequeue_async_page_present() to determine whether to deliver\\na READY event to the Guest. This function test token value of struct\\nkvm_vcpu_pv_apf_data, which must be reset to zero by Guest kernel when a\\nREADY event is finished by Guest. If value is zero meaning that a READY\\nevent is done, so the KVM can deliver another.\\nBut the kvm_arch_setup_async_pf() may produce a valid token with zero\\nvalue, which is confused with previous mention and may lead the loss of\\nthis READY event.\\n\\nThis bug may cause task blocked forever in Guest:\\n INFO: task stress:7532 blocked for more than 1254 seconds.\\n       Not tainted 5.10.0 #16\\n \\\"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\\\" disables this message.\\n task:stress          state:D stack:    0 pid: 7532 ppid:  1409\\n flags:0x00000080\\n Call Trace:\\n  __schedule+0x1e7/0x650\\n  schedule+0x46/0xb0\\n  kvm_async_pf_task_wait_schedule+0xad/0xe0\\n  ? exit_to_user_mode_prepare+0x60/0x70\\n  __kvm_handle_async_pf+0x4f/0xb0\\n  ? asm_exc_page_fault+0x8/0x30\\n  exc_page_fault+0x6f/0x110\\n  ? asm_exc_page_fault+0x8/0x30\\n  asm_exc_page_fault+0x1e/0x30\\n RIP: 0033:0x402d00\\n RSP: 002b:00007ffd31912500 EFLAGS: 00010206\\n RAX: 0000000000071000 RBX: ffffffffffffffff RCX: 00000000021a32b0\\n RDX: 000000000007d011 RSI: 000000000007d000 RDI: 00000000021262b0\\n RBP: 00000000021262b0 R08: 0000000000000003 R09: 0000000000000086\\n R10: 00000000000000eb R11: 00007fefbdf2baa0 R12: 0000000000000000\\n R13: 0000000000000002 R14: 000000000007d000 R15: 0000000000001000\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-08-22T03:31:41.483Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-48943\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-09-12T17:33:10.679Z\", \"dateReserved\": \"2024-08-22T01:27:53.623Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-08-22T03:30:14.027Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}