CVE-2022-48862

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue is related to a hung thread due to erroneous iotlb entries in the vhost component of the Linux kernel. Specifically, in vhost iotlb add range ctx(), the range size can overflow to 0 when start is 0 and last is ULONG MAX. This can happen when userspace sends an IOTLB message with iova=size=uaddr=0. As a result, an entry with size = 0, start = 0, last = ULONG MAX ends up in the iotlb, causing iotlb access ok() to loop indefinitely when a packet is sent. To fix this, two actions are recommended: return -EINVAL in vhost chr write iter() when userspace asks to map a range with size 0, and fix vhost iotlb add range ctx() to handle the range [0, ULONG MAX] by splitting it into two entries.

Recommendations To resolve the issue, follow these steps: