CVE-2022-1158

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to the fixed version

Description A flaw was found in the Kernel-based Virtual Machine (KVM) subsystem of the Linux kernel. The issue is related to the get user pages fast() function and involves writing data outside the buffer in memory. This flaw allows unprivileged local users on the host to write outside the userspace region and potentially corrupt the kernel, resulting in a denial of service condition. The vaddr and vm pgoff variables are controllable by user-mode processes, which can be exploited to cause the issue.

Recommendations For Linux Kernel versions prior to the fixed version, consider updating to a newer version that contains a fix for this issue. As a temporary workaround, restrict access to the KVM subsystem to minimize the risk of exploitation. Avoid using the get user pages fast() function until a patch is available.