CVE-2022-49884

Source
https://cve.org/CVERecord?id=CVE-2022-49884
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-49884.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2022-49884
Downstream
Published
2025-05-01T14:10:30.589Z
Modified
2026-03-20T12:22:29.886418Z
Summary
KVM: Initialize gfn_to_pfn_cache locks in dedicated helper
Details

In the Linux kernel, the following vulnerability has been resolved:

KVM: Initialize gfntopfn_cache locks in dedicated helper

Move the gfntopfncache lock initialization to another helper and call the new helper during VM/vCPU creation. There are race conditions possible due to kvmgfntopfncacheinit()'s ability to re-initialize the cache's locks.

For example: a race between ioctl(KVMXENHVMEVTCHNSEND) and kvmgfntopfncache_init() leads to a corrupted shinfo gpc lock.

            (thread 1)                |           (thread 2)
                                      |

kvmxensetevtchnfast | readlockirqsave(&gpc->lock, ...) | | kvmgfntopfncacheinit | rwlockinit(&gpc->lock) readunlockirqrestore(&gpc->lock, ...) |

Rename "cacheinit" and "cachedestroy" to activate+deactivate to avoid implying that the cache really is destroyed/freed.

Note, there more races in the newly named kvmgpcactivate() that will be addressed separately.

[sean: call out that this is a bug fix]

Database specific
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49884.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
982ed0de4753ed6e71dbd40f82a5a066baf133ed
Fixed
61242001d6c9c253df7645dab090842d8da08764
Fixed
52491a38b2c2411f3f0229dc6ad610349c704a41

Database specific

source
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-49884.json"