CVE-2022-49559

published 2025-02-26

CVE-2022-49559: In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Drop WARNs that assert a triple fault never "escapes" from L2 Remove WARNs that…

Priority P4 21 medium 5.5 CVSS 3.1

AV L AC L PR L UI N S U C N I N A H

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86: Drop WARNs that assert a triple fault never "escapes" from L2

Remove WARNs that sanity check that KVM never lets a triple fault for L2
escape and incorrectly end up in L1. In normal operation, the sanity
check is perfectly valid, but it incorrectly assumes that it's impossible
for userspace to induce KVM_REQ_TRIPLE_FAULT without bouncing through
KVM_RUN (which guarantees kvm_check_nested_state() will see and handle
the triple fault).

The WARN can currently be triggered if userspace injects a machine check
while L2 is active and CR4.MCE=0. And a future fix to allow save/restore
of KVM_REQ_TRIPLE_FAULT, e.g. so that a synthesized triple fault isn't
lost on migration, will make it trivially easy for userspace to trigger
the WARN.

Clearing KVM_REQ_TRIPLE_FAULT when forcibly leaving guest mode is
tempting, but wrong, especially if/when the request is saved/restored,
e.g. if userspace restores events (including a triple fault) and then
restores nested state (which may forcibly leave guest mode). Ignoring
the fact that KVM doesn't currently provide the necessary APIs, it's
userspace's responsibility to manage pending events during save/restore.

------------[ cut here ]------------
WARNING: CPU: 7 PID: 1399 at arch/x86/kvm/vmx/nested.c:4522 nested_vmx_vmexit+0x7fe/0xd90 [kvm_intel]
Modules linked in: kvm_intel kvm irqbypass
CPU: 7 PID: 1399 Comm: state_test Not tainted 5.17.0-rc3+ #808
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015
RIP: 0010:nested_vmx_vmexit+0x7fe/0xd90 [kvm_intel]
Call Trace:

vmx_leave_nested+0x30/0x40 [kvm_intel]
vmx_set_nested_state+0xca/0x3e0 [kvm_intel]
kvm_arch_vcpu_ioctl+0xf49/0x13e0 [kvm]
kvm_vcpu_ioctl+0x4b9/0x660 [kvm]
__x64_sys_ioctl+0x83/0xb0
do_syscall_64+0x3b/0xc0
entry_SYSCALL_64_after_hwframe+0x44/0xae

---[ end trace 0000000000000000 ]---

Affected

12 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 5.18.2-1 (bookworm)	linux 5.18.2-1 (bookworm)
linux	linux	—	—
linux	linux	>= cb6a32c2b8777ad31a02e585584d869251a790e3 < 8d3a2aa0976f57320ba89baf9d57fb158dd0cd0d	8d3a2aa0976f57320ba89baf9d57fb158dd0cd0d
linux	linux	>= cb6a32c2b8777ad31a02e585584d869251a790e3 < f476a59d5c86c02a79eef893c6da86735f2977ac	f476a59d5c86c02a79eef893c6da86735f2977ac
linux	linux	>= cb6a32c2b8777ad31a02e585584d869251a790e3 < 7de373c9b48229e428ecdb8fbde269c5a8617fd2	7de373c9b48229e428ecdb8fbde269c5a8617fd2
linux	linux	>= cb6a32c2b8777ad31a02e585584d869251a790e3 < 45846661d10422ce9e22da21f8277540b29eca22	45846661d10422ce9e22da21f8277540b29eca22
linux	linux_kernel	>= 0 < 5.18.2-1	5.18.2-1
linux	linux_kernel	>= 0 < 5.18.2-1	5.18.2-1
linux	linux_kernel	>= 0 < 5.18.2-1	5.18.2-1
linux	linux_kernel	>= 5.13 < 5.15.45	5.15.45
linux	linux_kernel	>= 5.16 < 5.17.13	5.17.13
linux	linux_kernel	>= 5.18 < 5.18.2	5.18.2

CVSS provenance

nvd v3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

osv 5.5 MEDIUM

vendor_debian 5.5 MEDIUM

vendor_redhat 5.5 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.