Linux kernel KVM: use-after-free from consuming an inactive gfn_to_pfn_cache via Xen shared-info race

Impact

kvm_gpc_check() and kvm_gpc_refresh() did not reject an inactive gfn_to_pfn_cache, so a cache could end up valid but not on the mmu_notifier invalidation list - a classic use-after-free setup, reachable by racing KVM_XEN_ATTR_TYPE_SHARED_INFO against KVM_XEN_HVM_EVTCHN_SEND until the event-channel path dereferences a NULL or stale khva. A host-local attacker with /dev/kvm can crash the hypervisor, and a kernel UAF of this shape is the sort that gets driven toward privilege escalation. On a GPU host this means every co-tenant job on the node goes with it. Only hosts running KVM with Xen emulation enabled are affected; a plain KVM/QEMU fleet without KVM_XEN does not reach this code.

Who can reach it

Local user with access to /dev/kvm on a host built with KVM Xen emulation; the attacker drives it through VM ioctls. No remote path and no unauthenticated reach.

What to do

Update to a stable kernel carrying the fix (commits bfa9672f8fc9 / ecbcf030b456) and reboot the host, or reload the kvm module with all guests stopped. If KVM Xen emulation is not needed - it is not, on a normal GPU cloud - build or configure without it, which closes the path without a maintenance window for the kernel itself.

References

Related entries

• Linux kernel (drivers/gpu/drm/i915/gt): The GPU migration copy path used plain ints for sizes that a tenant controlsCVE-2022-49963 · Linux kernel (drivers/gpu/drm/i915/gt)High
• Linux kernel bpf x86: erroneous free of a non-finalized bpf_prog_pack frees a whole 2MB JIT pageCVE-2022-50168 · Linux kernel BPF x86-64 JIT (bpf_prog_pack freed before finalize)High
• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): A double free in the amdkfd (KFD compute driverCVE-2022-50303 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)High
• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): A NULL pointer dereference in the amdkfd (KFD computeCVE-2022-50354 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)High
• Linux kernel iomap: memory corruption when recording I/O errors during writebackCVE-2022-50406 · Linux kernel iomap writeback (error recording via errseq_set on an already-freed mapping)High
• Linux kernel (drivers/gpu/drm/vmwgfx): The dimensions of a DMA surface-copy box submitted in the command stream wereCVE-2022-50440 · Linux kernel (drivers/gpu/drm/vmwgfx)High