KVM TLB Flush Flaw Lets Guest Users Compromise Guest Kernels

CVE-2022-39189 affects the Linux kernel’s x86 KVM subsystem, where instruction emulation can leave the KVM_VCPU_PREEMPTED flag set and mishandle paravirtualized TLB flushes. Other guest vCPUs may then skip required TLB-flush IPIs while emulation accesses memory using stale guest-virtual translations, enabling an unprivileged user inside a VM to compromise the guest kernel or cause guest malfunction. The issue affects the KVM_FEATURE_PV_TLB_FLUSH functionality introduced in Linux 4.16 and was demonstrated through emulated VMMCALL and port-I/O operations.

The upstream correction, commit 6cd88243c7e03845a450795e134b488fc2afb736, was merged for Linux 5.19 and backported to the stable 5.15 and 5.18 kernel trees; affected kernels are generally versions before 5.18.17. Red Hat rated the vulnerability Moderate with CVSS 7.0 and issued fixes for affected RHEL 8, RHEL 8 kernel-rt, RHEL 8.6 EUS, RHEL 9, RHEL 9 kernel-rt, and Red Hat Virtualization 4 on RHEL 8 packages; Red Hat reported no qualifying mitigation, making deployment of the relevant kernel updates the required remediation.