Linux KVM Flaw Lets Low-Privilege Guest Crash Host Virtualization
Vulnerability Disclosure · 2 sources · Updated 2mo ago · First seen Nov 8, 2022
CVE-2022-1852 is a moderate-severity NULL-pointer dereference in the Linux kernel's x86 KVM instruction-emulation path. A low-privileged attacker in an Intel-based virtual-machine guest can execute an illegal instruction and trigger a fault in x86_emulate_insn, causing a denial of service. Red Hat assigned a CVSS v3.1 score of 5.5 and classified the defect as CWE-476.
The upstream Linux fix, commit fee060cd52d69c114b62d1a2948ea9648b5131f9, prevents KVM from invoking the x86 emulator before an instruction has been decoded, avoiding use of stale emulation context after breakpoint-related handling. Red Hat released corrected kernel packages for affected RHEL 8 and RHEL 9 systems and related products; RHEL 6 and 7 kernels are not affected. Where patching cannot be performed promptly, Red Hat recommends blacklisting the affected KVM kernel module at boot to prevent it from loading.
