CVE-2022-48764

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2022-48764

Import Source

https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-48764.json

JSON Data

https://api.test.osv.dev/v1/vulns/CVE-2022-48764

Downstream

DEBIAN-CVE-2022-48764

UBUNTU-CVE-2022-48764

Published

2024-06-20T11:13:41.170Z

Modified

2025-11-28T02:34:40.459809Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L CVSS Calculator

Summary

KVM: x86: Free kvm_cpuid_entry2 array on post-KVM_RUN KVM_SET_CPUID{,2}

Details

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86: Free kvmcpuidentry2 array on post-KVMRUN KVMSET_CPUID{,2}

Free the "struct kvmcpuidentry2" array on successful post-KVMRUN KVMSETCPUID{,2} to fix a memory leak, the callers of kvmset_cpuid() free the array only on failure.

BUG: memory leak unreferenced object 0xffff88810963a800 (size 2048): comm "syz-executor025", pid 3610, jiffies 4294944928 (age 8.080s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 0d 00 00 00 ................ 47 65 6e 75 6e 74 65 6c 69 6e 65 49 00 00 00 00 GenuntelineI.... backtrace: [<ffffffff814948ee>] kmallocnode include/linux/slab.h:604 [inline] [<ffffffff814948ee>] kvmallocnode+0x3e/0x100 mm/util.c:580 [<ffffffff814950f2>] kvmalloc include/linux/slab.h:732 [inline] [<ffffffff814950f2>] vmemdupuser+0x22/0x100 mm/util.c:199 [<ffffffff8109f5ff>] kvmvcpuioctlsetcpuid2+0x8f/0xf0 arch/x86/kvm/cpuid.c:423 [<ffffffff810711b9>] kvmarchvcpuioctl+0xb99/0x1e60 arch/x86/kvm/x86.c:5251 [<ffffffff8103e92d>] kvmvcpuioctl+0x4ad/0x950 arch/x86/kvm/../../../virt/kvm/kvmmain.c:4066 [<ffffffff815afacc>] vfsioctl fs/ioctl.c:51 [inline] [<ffffffff815afacc>] _dosysioctl fs/ioctl.c:874 [inline] [<ffffffff815afacc>] _sesysioctl fs/ioctl.c:860 [inline] [<ffffffff815afacc>] _x64sysioctl+0xfc/0x140 fs/ioctl.c:860 [<ffffffff844a3335>] dosyscallx64 arch/x86/entry/common.c:50 [inline] [<ffffffff844a3335>] dosyscall64+0x35/0xb0 arch/x86/entry/common.c:80 [<ffffffff84600068>] entrySYSCALL64after_hwframe+0x44/0xae

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/48xxx/CVE-2022-48764.json",
    "cna_assigner": "Linux"
}

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

24e7590c60aa9487b8e43583dc9885f62f8216c1

Fixed

b9ee734a14bb685b2088f2176d82b34cb4e30dbc

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

c6617c61e8fe44b9e9fdfede921f61cac6b5149d

Fixed

811f95ff95270e6048197821434d9301e3d7f07c

Affected versions

v5.*

v5.16

v5.16-rc5

v5.16-rc6

v5.16-rc7

v5.16-rc8

v5.16.3

v5.16.4

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-48764.json"

vanir_signatures

[
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@811f95ff95270e6048197821434d9301e3d7f07c",
        "digest": {
            "function_hash": "242406575157876428829990984552510853938",
            "length": 455.0
        },
        "signature_type": "Function",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "function": "kvm_set_cpuid",
            "file": "arch/x86/kvm/cpuid.c"
        },
        "id": "CVE-2022-48764-745a6c2d"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b9ee734a14bb685b2088f2176d82b34cb4e30dbc",
        "digest": {
            "line_hashes": [
                "233436572750075803578144259780856715126",
                "41730423854987191239891431848244703931",
                "254620035326868785728089665676187458312",
                "279072491104725922225612447298806422179",
                "10485295917080181908335749494675121485"
            ],
            "threshold": 0.9
        },
        "signature_type": "Line",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "arch/x86/kvm/cpuid.c"
        },
        "id": "CVE-2022-48764-93ebae49"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b9ee734a14bb685b2088f2176d82b34cb4e30dbc",
        "digest": {
            "function_hash": "153927164955343056787309996921469504484",
            "length": 447.0
        },
        "signature_type": "Function",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "function": "kvm_set_cpuid",
            "file": "arch/x86/kvm/cpuid.c"
        },
        "id": "CVE-2022-48764-d7777bbe"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@811f95ff95270e6048197821434d9301e3d7f07c",
        "digest": {
            "line_hashes": [
                "233436572750075803578144259780856715126",
                "41730423854987191239891431848244703931",
                "224133087938337314300137983215079523892",
                "329352030608504586348057241036842379611",
                "247539571567572539695531100149833512704"
            ],
            "threshold": 0.9
        },
        "signature_type": "Line",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "arch/x86/kvm/cpuid.c"
        },
        "id": "CVE-2022-48764-fbeaf517"
    }
]

Linux / Kernel

Package

Name: Kernel

Affected ranges

Type: ECOSYSTEM
Events: Introduced

5.16.3

Fixed

5.16.5

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-48764.json"