KVM: arm64 - Prevent kmemleak from accessing pKVM memory
Summary
GSD-2022-1004474: KVM: arm64: Prevent kmemleak from accessing pKVM memory. Affects Kernel versions >= a7259df7670240ee03b0cfce8a3e5d3773911e24, < 638be56ae9cc5c25a81c525df20b1b9d92b08613. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a critical component of the Linux operating system. It provides the core functionality and acts as an interface between the hardware and software layers. KVM (Kernel-based Virtual Machine) is a virtualization infrastructure for the Linux Kernel that allows running virtual machines on a host machine. The arm64 architecture is specifically designed for 64-bit ARM processors. The vulnerability in question affects the arm64 implementation of KVM and involves the interaction with kmemleak, a kernel memory leak detector.
Vulnerability Detail
The vulnerability in KVM arm64 allows kmemleak to access pKVM (protected KVM) memory. This could potentially lead to the exposure of sensitive information from the virtual machines running on the host system. The vulnerability was introduced in Linux Kernel version 5.15 by commit a7259df7670240ee03b0cfce8a3e5d3773911e24 and is fixed in version 5.15.51 by commit 638be56ae9cc5c25a81c525df20b1b9d92b08613. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
To fix this vulnerability, it is recommended to update the Linux Kernel to version 5.15.51 or later. This can be done by fetching the latest version from the official Linux Kernel repository and following the installation instructions provided by the distribution or system administrator. It is important to ensure that the updated Kernel is properly tested and validated before deploying it in production environments.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The KVM arm64 vulnerability allows kmemleak to access pKVM memory, potentially leading to the exposure of sensitive information from virtual machines. It is crucial to update the Linux Kernel to version 5.15.51 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
KVM (Kernel-based Virtual Machine) is a virtualization infrastructure for the Linux Kernel that allows running virtual machines on a host machine.
The arm64 architecture is specifically designed for 64-bit ARM processors.
kmemleak is a kernel memory leak detector that helps identify and track memory leaks in the Linux Kernel.
This vulnerability can potentially expose sensitive information from the virtual machines running on the host system, leading to a breach of confidentiality.
You can use Vulert's playground at Vulert Scanner to check if your system is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.