CVE-2022-50471: In the Linux kernel, the following vulnerability has been resolved: xen/gntdev: Accommodate VMA splitting Prior to this commit, the gntdev driver code did not…

PriorityP422medium5.5CVSS 3.1

AVLACLPRLUINSUCNINAH

EPSS

0.15%

4.5th percentile

In the Linux kernel, the following vulnerability has been resolved:

xen/gntdev: Accommodate VMA splitting

Prior to this commit, the gntdev driver code did not handle the
following scenario correctly with paravirtualized (PV) Xen domains:

* User process sets up a gntdev mapping composed of two grant mappings
(i.e., two pages shared by another Xen domain).
* User process munmap()s one of the pages.
* User process munmap()s the remaining page.
* User process exits.

In the scenario above, the user process would cause the kernel to log
the following messages in dmesg for the first munmap(), and the second
munmap() call would result in similar log messages:

BUG: Bad page map in process doublemap.test pte:... pmd:...
page:0000000057c97bff refcount:1 mapcount:-1 \
mapping:0000000000000000 index:0x0 pfn:...
...
page dumped because: bad pte
...
file:gntdev fault:0x0 mmap:gntdev_mmap [xen_gntdev] readpage:0x0
...
Call Trace:

dump_stack_lvl+0x46/0x5e
print_bad_pte.cold+0x66/0xb6
unmap_page_range+0x7e5/0xdc0
unmap_vmas+0x78/0xf0
unmap_region+0xa8/0x110
__do_munmap+0x1ea/0x4e0
__vm_munmap+0x75/0x120
__x64_sys_munmap+0x28/0x40
do_syscall_64+0x38/0x90
entry_SYSCALL_64_after_hwframe+0x61/0xcb
...

For each munmap() call, the Xen hypervisor (if built with CONFIG_DEBUG)
would print out the following and trigger a general protection fault in
the affected Xen PV domain:

(XEN) d0v... Attempt to implicitly unmap d0's grant PTE ...
(XEN) d0v... Attempt to implicitly unmap d0's grant PTE ...

As of this writing, gntdev_grant_map structure's vma field (referred to
as map->vma below) is mainly used for checking the start and end
addresses of mappings. However, with split VMAs, these may change, and
there could be more than one VMA associated with a gntdev mapping.
Hence, remove the use of map->vma and rely on map->pages_vm_start for
the original start address and on (map->count notifier)" call to
the end of gntdev_put_map, so that the MMU notifier is only removed
after the closing of t

Affected

15 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 6.0.3-1 (bookworm)	linux 6.0.3-1 (bookworm)
linux	linux	—	—
linux	linux	>= ab31523c2fcac557226bac72cbdf5fafe01f9a26 < 3c6a888e352283a14f37b9b433cd598a1a3a7dd0	3c6a888e352283a14f37b9b433cd598a1a3a7dd0
linux	linux	>= ab31523c2fcac557226bac72cbdf5fafe01f9a26 < 7c16d0a4e6a436b4e7c92bead3fab55aaa4c1141	7c16d0a4e6a436b4e7c92bead3fab55aaa4c1141
linux	linux	>= ab31523c2fcac557226bac72cbdf5fafe01f9a26 < 4fb4053d90caa9985b87ec0e0c32c66a55bdfa3a	4fb4053d90caa9985b87ec0e0c32c66a55bdfa3a
linux	linux	>= ab31523c2fcac557226bac72cbdf5fafe01f9a26 < cdafa219ace013c594e2491158ad1b51f9923dde	cdafa219ace013c594e2491158ad1b51f9923dde
linux	linux	>= ab31523c2fcac557226bac72cbdf5fafe01f9a26 < 5c13a4a0291b30191eff9ead8d010e1ca43a4d0c	5c13a4a0291b30191eff9ead8d010e1ca43a4d0c
linux	linux_kernel	>= 0 < 5.10.158-1	5.10.158-1
linux	linux_kernel	>= 0 < 6.0.3-1	6.0.3-1
linux	linux_kernel	>= 0 < 6.0.3-1	6.0.3-1
linux	linux_kernel	>= 0 < 6.0.3-1	6.0.3-1
linux	linux_kernel	>= 2.6.38 < 5.10.152	5.10.152
linux	linux_kernel	>= 5.11 < 5.15.75	5.15.75
linux	linux_kernel	>= 5.16 < 5.19.17	5.19.17
linux	linux_kernel	>= 6.0 < 6.0.3	6.0.3

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

osv5.5MEDIUM

vendor_debian5.5MEDIUM

vendor_redhat5.5MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.