CVE-2022-48943

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86/mmu: make apf token non-zero to fix bug

In current async pagefault logic, when a page is ready, KVM relies on

kvm_arch_can_dequeue_async_page_present() to determine whether to deliver

a READY event to the Guest. This function test token value of struct

kvm_vcpu_pv_apf_data, which must be reset to zero by Guest kernel when a

READY event is finished by Guest. If value is zero meaning that a READY

event is done, so the KVM can deliver another.

But the kvm_arch_setup_async_pf() may produce a valid token with zero

value, which is confused with previous mention and may lead the loss of

this READY event.

This bug may cause task blocked forever in Guest:

INFO: task stress:7532 blocked for more than 1254 seconds.

Not tainted 5.10.0 #16

"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.

task:stress state:D stack: 0 pid: 7532 ppid: 1409

flags:0x00000080

Call Trace:

__s

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References