{"id":"DEBIAN-CVE-2022-49882","details":"In the Linux kernel, the following vulnerability has been resolved:  KVM: Reject attempts to consume or refresh inactive gfn_to_pfn_cache  Reject kvm_gpc_check() and kvm_gpc_refresh() if the cache is inactive. Not checking the active flag during refresh is particularly egregious, as KVM can end up with a valid, inactive cache, which can lead to a variety of use-after-free bugs, e.g. consuming a NULL kernel pointer or missing an mmu_notifier invalidation due to the cache not being on the list of gfns to invalidate.  Note, \"active\" needs to be set if and only if the cache is on the list of caches, i.e. is reachable via mmu_notifier events.  If a relevant mmu_notifier event occurs while the cache is \"active\" but not on the list, KVM will not acquire the cache's lock and so will not serailize the mmu_notifier event with active users and/or kvm_gpc_refresh().  A race between KVM_XEN_ATTR_TYPE_SHARED_INFO and KVM_XEN_HVM_EVTCHN_SEND can be exploited to trigger the bug.  1. Deactivate shinfo cache:  kvm_xen_hvm_set_attr case KVM_XEN_ATTR_TYPE_SHARED_INFO  kvm_gpc_deactivate   kvm_gpc_unmap    gpc-\u003evalid = false    gpc-\u003ekhva = NULL   gpc-\u003eactive = false  Result: active = false, valid = false  2. Cause cache refresh:  kvm_arch_vm_ioctl case KVM_XEN_HVM_EVTCHN_SEND  kvm_xen_hvm_evtchn_send   kvm_xen_set_evtchn    kvm_xen_set_evtchn_fast     kvm_gpc_check     return -EWOULDBLOCK because !gpc-\u003evalid    kvm_xen_set_evtchn_fast     return -EWOULDBLOCK    kvm_gpc_refresh     hva_to_pfn_retry      gpc-\u003evalid = true      gpc-\u003ekhva = not NULL  Result: active = false, valid = true  3. Race ioctl KVM_XEN_HVM_EVTCHN_SEND against ioctl KVM_XEN_ATTR_TYPE_SHARED_INFO:  kvm_arch_vm_ioctl case KVM_XEN_HVM_EVTCHN_SEND  kvm_xen_hvm_evtchn_send   kvm_xen_set_evtchn    kvm_xen_set_evtchn_fast     read_lock gpc-\u003elock                                           kvm_xen_hvm_set_attr case                                           KVM_XEN_ATTR_TYPE_SHARED_INFO                                            mutex_lock kvm-\u003elock                                            kvm_xen_shared_info_init                                             kvm_gpc_activate                                              gpc-\u003ekhva = NULL     kvm_gpc_check      [ Check passes because gpc-\u003evalid is        still true, even though gpc-\u003ekhva        is already NULL. ]     shinfo = gpc-\u003ekhva     pending_bits = shinfo-\u003eevtchn_pending     CRASH: test_and_set_bit(..., pending_bits)","modified":"2026-08-27T23:04:30.668422892Z","published":"2025-05-01T15:16:13.183Z","upstream":["CVE-2022-49882"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2022-49882"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.8-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2022-49882.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.8-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2022-49882.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.8-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2022-49882.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}