GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-50227 (GCVE-0-2022-50227)

Vulnerability from cvelistv5 – Published: 2025-06-18 11:03 – Updated: 2026-08-05 08:57
VLAI
Title
KVM: x86/xen: Initialize Xen timer only once
Summary
In the Linux kernel, the following vulnerability has been resolved: KVM: x86/xen: Initialize Xen timer only once Add a check for existing xen timers before initializing a new one. Currently kvm_xen_init_timer() is called on every KVM_XEN_VCPU_ATTR_TYPE_TIMER, which is causing the following ODEBUG crash when vcpu->arch.xen.timer is already set. ODEBUG: init active (active state 0) object type: hrtimer hint: xen_timer_callbac0 RIP: 0010:debug_print_object+0x16e/0x250 lib/debugobjects.c:502 Call Trace: __debug_object_init debug_hrtimer_init debug_init hrtimer_init kvm_xen_init_timer kvm_xen_vcpu_set_attr kvm_arch_vcpu_ioctl kvm_vcpu_ioctl vfs_ioctl
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 536395260582be7443b0b35b0bbb89ffe3947f62 , < 9a9b5771e930f408c3419799000f76a9abaf2278 (git)
Affected: 536395260582be7443b0b35b0bbb89ffe3947f62 , < af735db31285fa699384c649be72a9f32ecbb665 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.19
Unaffected: 0 , < 5.19 (semver)
Unaffected: 5.19.2 , ≤ 5.19.* (semver)
Unaffected: 6.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/xen.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9a9b5771e930f408c3419799000f76a9abaf2278",
              "status": "affected",
              "version": "536395260582be7443b0b35b0bbb89ffe3947f62",
              "versionType": "git"
            },
            {
              "lessThan": "af735db31285fa699384c649be72a9f32ecbb665",
              "status": "affected",
              "version": "536395260582be7443b0b35b0bbb89ffe3947f62",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/xen.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.19"
            },
            {
              "lessThan": "5.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.19.*",
              "status": "unaffected",
              "version": "5.19.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19.2",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86/xen: Initialize Xen timer only once\n\nAdd a check for existing xen timers before initializing a new one.\n\nCurrently kvm_xen_init_timer() is called on every\nKVM_XEN_VCPU_ATTR_TYPE_TIMER, which is causing the following ODEBUG\ncrash when vcpu-\u003earch.xen.timer is already set.\n\nODEBUG: init active (active state 0)\nobject type: hrtimer hint: xen_timer_callbac0\nRIP: 0010:debug_print_object+0x16e/0x250 lib/debugobjects.c:502\nCall Trace:\n__debug_object_init\ndebug_hrtimer_init\ndebug_init\nhrtimer_init\nkvm_xen_init_timer\nkvm_xen_vcpu_set_attr\nkvm_arch_vcpu_ioctl\nkvm_vcpu_ioctl\nvfs_ioctl"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Triggered only via the host KVM_XEN_VCPU_SET_ATTR vCPU ioctl on /dev/kvm; guest Xen timer hypercalls call kvm_xen_start_timer but never kvm_xen_init_timer, so this is not remotely reachable.\nAC:L - An attacker with a vCPU fd can reliably reproduce by issuing KVM_XEN_VCPU_ATTR_TYPE_TIMER twice with a non-zero port and expires_ns, fully controlling both the initial arming and the re-init; no race or external condition is required.\nPR:L - Reachable by any unprivileged local user who can open /dev/kvm (typically kvm-group membership), create a VM/vCPU, and issue the ioctl; no CAP_SYS_ADMIN or init-namespace root is required.\nUI:N - Exploitation is entirely attacker-driven through ioctl calls; no victim action is needed.\nS:U - This is host userspace (VMM) corrupting the host kernel timer subsystem, not a guest-to-host escape; impact stays within the host kernel authority.\nC:H - Without DEBUG_OBJECTS, hrtimer_init memset()s an still-enqueued hrtimer, corrupting the timerqueue rbtree and enabling use-after-free primitives that can yield arbitrary kernel reads.\nI:H - The same timer-queue corruption provides a write/UAF primitive against kernel timer structures, which can be leveraged for control-flow hijacking or arbitrary writes.\nA:H - Re-init of an active hrtimer causes kernel WARN/oops under debugobjects and timer-subsystem crashes or hangs on production kernels when the corrupted rbtree is walked."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:57:47.222Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9a9b5771e930f408c3419799000f76a9abaf2278"
        },
        {
          "url": "https://git.kernel.org/stable/c/af735db31285fa699384c649be72a9f32ecbb665"
        }
      ],
      "title": "KVM: x86/xen: Initialize Xen timer only once",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50227",
    "datePublished": "2025-06-18T11:03:59.885Z",
    "dateReserved": "2025-06-18T10:57:27.432Z",
    "dateUpdated": "2026-08-05T08:57:47.222Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-50227",
      "date": "2026-09-16",
      "epss": "0.00186",
      "percentile": "0.08479"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-50227\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-06-18T11:15:53.743\",\"lastModified\":\"2026-08-04T10:18:07.817\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nKVM: x86/xen: Initialize Xen timer only once\\n\\nAdd a check for existing xen timers before initializing a new one.\\n\\nCurrently kvm_xen_init_timer() is called on every\\nKVM_XEN_VCPU_ATTR_TYPE_TIMER, which is causing the following ODEBUG\\ncrash when vcpu-\u003earch.xen.timer is already set.\\n\\nODEBUG: init active (active state 0)\\nobject type: hrtimer hint: xen_timer_callbac0\\nRIP: 0010:debug_print_object+0x16e/0x250 lib/debugobjects.c:502\\nCall Trace:\\n__debug_object_init\\ndebug_hrtimer_init\\ndebug_init\\nhrtimer_init\\nkvm_xen_init_timer\\nkvm_xen_vcpu_set_attr\\nkvm_arch_vcpu_ioctl\\nkvm_vcpu_ioctl\\nvfs_ioctl\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: KVM: x86/xen: Inicializar el temporizador Xen solo una vez. Se ha a\u00f1adido una comprobaci\u00f3n de los temporizadores Xen existentes antes de inicializar uno nuevo. Actualmente, se llama a kvm_xen_init_timer() en cada KVM_XEN_VCPU_ATTR_TYPE_TIMER, lo que provoca el siguiente fallo de ODEBUG cuando vcpu-\u0026gt;arch.xen.timer ya est\u00e1 configurado. ODEBUG: init activo (estado activo 0) tipo de objeto: hrtimer sugerencia: xen_timer_callbac0 RIP: 0010:debug_print_object+0x16e/0x250 lib/debugobjects.c:502 Seguimiento de llamadas: __debug_object_init debug_hrtimer_init debug_init hrtimer_init kvm_xen_init_timer kvm_xen_vcpu_set_attr kvm_arch_vcpu_ioctl kvm_vcpu_ioctl vfs_ioctl\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"arch/x86/kvm/xen.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"536395260582be7443b0b35b0bbb89ffe3947f62\",\"lessThan\":\"9a9b5771e930f408c3419799000f76a9abaf2278\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"536395260582be7443b0b35b0bbb89ffe3947f62\",\"lessThan\":\"af735db31285fa699384c649be72a9f32ecbb665\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"arch/x86/kvm/xen.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.19\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.19\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.19.2\",\"lessThanOrEqual\":\"5.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.19\",\"versionEndExcluding\":\"5.19.2\",\"matchCriteriaId\":\"A1A2A5A5-4598-4D7E-BA07-4660398D6C8F\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/9a9b5771e930f408c3419799000f76a9abaf2278\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/af735db31285fa699384c649be72a9f32ecbb665\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:40:27+00:00",
      "cve": "CVE-2022-50227",
      "id": "CVE-2022-50227",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:fixed": "201",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "166",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: KVM: x86/xen: Initialize Xen timer only once",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-50227.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-03T16:57:31Z",
      "cve": "CVE-2022-50227",
      "id": "CVE-2022-50227",
      "initial_release_date": "2025-06-19T03:38:37Z",
      "product_status:known_not_affected": "509",
      "product_status:recommended": "27",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-50227",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-50227.json",
      "version": "11"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.