UBUNTU-CVE-2022-48943
In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: make apf token non-zero to fix bug In current async pagefault logic, when a page is ready, KVM relies on kvm_arch_can_dequeue_async_page_present() to determine whether to deliver a READY event to the Guest. This function test token value of struct kvm_vcpu_pv_apf_data, which must be reset to zero by Guest kernel when a READY event is finished by Guest. If value is zero meaning that a READY event is done, so the KVM can deliver another. But the kvm_arch_setup_async_pf() may produce a valid token with zero value, which is confused with previous mention and may lead the loss of this READY event. This bug may cause task blocked forever in Guest: INFO: task stress:7532 blocked for more than 1254 seconds. Not tainted 5.10.0 #16 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:stress state:D stack: 0 pid: 7532 ppid: 1409 flags:0x00000080 Call Trace: __schedule+0x1e7/0x650 schedule+0x46/0xb0 kvm_async_pf_task_wait_schedule+0xad/0xe0 ? exit_to_user_mode_prepare+0x60/0x70 __kvm_handle_async_pf+0x4f/0xb0 ? asm_exc_page_fault+0x8/0x30 exc_page_fault+0x6f/0x110 ? asm_exc_page_fault+0x8/0x30 asm_exc_page_fault+0x1e/0x30 RIP: 0033:0x402d00 RSP: 002b:00007ffd31912500 EFLAGS: 00010206 RAX: 0000000000071000 RBX: ffffffffffffffff RCX: 00000000021a32b0 RDX: 000000000007d011 RSI: 000000000007d000 RDI: 00000000021262b0 RBP: 00000000021262b0 R08: 0000000000000003 R09: 0000000000000086 R10: 00000000000000eb R11: 00007fefbdf2baa0 R12: 0000000000000000 R13: 0000000000000002 R14: 000000000007d000 R15: 0000000000001000
02 / AFFECTED SOFTWARE
Affected packages
11 explicit affected versions
1 explicit affected versions
50 explicit affected versions
6 explicit affected versions
12 explicit affected versions
19 explicit affected versions
6 explicit affected versions
69 explicit affected versions
10 explicit affected versions
7 explicit affected versions
96 explicit affected versions
13 explicit affected versions
66 explicit affected versions
35 explicit affected versions
18 explicit affected versions
97 explicit affected versions
98 explicit affected versions
13 explicit affected versions
4 explicit affected versions
23 explicit affected versions
102 explicit affected versions
1 explicit affected versions
1 explicit affected versions
21 explicit affected versions
16 explicit affected versions
10 explicit affected versions
53 explicit affected versions
7 explicit affected versions
12 explicit affected versions
12 explicit affected versions
14 explicit affected versions
1 explicit affected versions
7 explicit affected versions
86 explicit affected versions
12 explicit affected versions
101 explicit affected versions
109 explicit affected versions
12 explicit affected versions
97 explicit affected versions
10 explicit affected versions
168 explicit affected versions
37 explicit affected versions
101 explicit affected versions
13 explicit affected versions
10 explicit affected versions
1 explicit affected versions
36 explicit affected versions
26 explicit affected versions
13 explicit affected versions
1 explicit affected versions
29 explicit affected versions
89 explicit affected versions
13 explicit affected versions
1 explicit affected versions
84 explicit affected versions
101 explicit affected versions
33 explicit affected versions
23 explicit affected versions
10 explicit affected versions
95 explicit affected versions
11 explicit affected versions
12 explicit affected versions
118 explicit affected versions
7 explicit affected versions
12 explicit affected versions
99 explicit affected versions
2 explicit affected versions
111 explicit affected versions
131 explicit affected versions
10 explicit affected versions
26 explicit affected versions
35 explicit affected versions
13 explicit affected versions
118 explicit affected versions
59 explicit affected versions
16 explicit affected versions
175 explicit affected versions
3 explicit affected versions
72 explicit affected versions
1 explicit affected versions
66 explicit affected versions
51 explicit affected versions
71 explicit affected versions
12 explicit affected versions
27 explicit affected versions
1 explicit affected versions
1 explicit affected versions
75 explicit affected versions
8 explicit affected versions
5 explicit affected versions
8 explicit affected versions
1 explicit affected versions
10 explicit affected versions
13 explicit affected versions
88 explicit affected versions
13 explicit affected versions
53 explicit affected versions
7 explicit affected versions
73 explicit affected versions
10 explicit affected versions
12 explicit affected versions
88 explicit affected versions
44 explicit affected versions
16 explicit affected versions
3 explicit affected versions
13 explicit affected versions
26 explicit affected versions
37 explicit affected versions
14 explicit affected versions
38 explicit affected versions
9 explicit affected versions
11 explicit affected versions
145 explicit affected versions
7 explicit affected versions
78 explicit affected versions
60 explicit affected versions
122 explicit affected versions
101 explicit affected versions
4 explicit affected versions
94 explicit affected versions
13 explicit affected versions
43 explicit affected versions
54 explicit affected versions
125 explicit affected versions
145 explicit affected versions
10 explicit affected versions
8 explicit affected versions
14 explicit affected versions
89 explicit affected versions
4 explicit affected versions
78 explicit affected versions
1 explicit affected versions
48 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: make apf token non-zero to fix bug In current async pagefault logic, when a page is ready, KVM relies on kvm_arch_can_dequeue_async_page_present() to determine whether to deliver a READY event to the Guest. This function test token value of struct kvm_vcpu_pv_apf_data, which must be reset to zero by Guest kernel when a READY event is finished by Guest. If value is zero meaning that a READY event is done, so the KVM can deliver another. But the kvm_arch_setup_async_pf() may produce a valid token with zero value, which is confused with previous mention and may lead the loss of this READY event. This bug may cause task blocked forever in Guest: INFO: task stress:7532 blocked for more than 1254 seconds. Not tainted 5.10.0 #16 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:stress state:D stack: 0 pid: 7532 ppid: 1409 flags:0x00000080 Call Trace: __schedule+0x1e7/0x650 schedule+0x46/0xb0 kvm_async_pf_task_wait_schedule+0xad/0xe0 ? exit_to_user_mode_prepare+0x60/0x70 __kvm_handle_async_pf+0x4f/0xb0 ? asm_exc_page_fault+0x8/0x30 exc_page_fault+0x6f/0x110 ? asm_exc_page_fault+0x8/0x30 asm_exc_page_fault+0x1e/0x30 RIP: 0033:0x402d00 RSP: 002b:00007ffd31912500 EFLAGS: 00010206 RAX: 0000000000071000 RBX: ffffffffffffffff RCX: 00000000021a32b0 RDX: 000000000007d011 RSI: 000000000007d000 RDI: 00000000021262b0 RBP: 00000000021262b0 R08: 0000000000000003 R09: 0000000000000086 R10: 00000000000000eb R11: 00007fefbdf2baa0 R12: 0000000000000000 R13: 0000000000000002 R14: 000000000007d000 R15: 0000000000001000
05 / REFERENCES
Further evidence
- https://git.kernel.org/linus/6f3c1fc53d86d580d8d6d749c4af23705e4f6f79
- https://git.kernel.org/stable/c/4c3644b6c96c5daa5149e5abddc07234eea47c7c
- https://git.kernel.org/stable/c/62040f5cd7d937de547836e747b6aa8212fec573
- https://git.kernel.org/stable/c/6f3c1fc53d86d580d8d6d749c4af23705e4f6f79
- https://git.kernel.org/stable/c/72fdfc75d4217b32363cc80def3de2cb3fef3f02
- https://ubuntu.com/security/CVE-2022-48943
- https://ubuntu.com/security/notices/USN-7121-1
- https://ubuntu.com/security/notices/USN-7121-2
- https://ubuntu.com/security/notices/USN-7121-3
- https://ubuntu.com/security/notices/USN-7122-1
- https://ubuntu.com/security/notices/USN-7148-1
- https://ubuntu.com/security/notices/USN-7159-1
- https://ubuntu.com/security/notices/USN-7159-2
- https://ubuntu.com/security/notices/USN-7159-3
- https://ubuntu.com/security/notices/USN-7159-4
- https://ubuntu.com/security/notices/USN-7159-5
- https://ubuntu.com/security/notices/USN-7195-1
- https://ubuntu.com/security/notices/USN-7195-2
- https://www.cve.org/CVERecord?id=CVE-2022-48943