KVM: arm64 - Avoid consuming a stale esr value when SError occur
Summary
GSD-2022-1000580: KVM: arm64: Avoid consuming a stale esr value when SError occur. Affects Kernel versions >= defe21f49bc98b095300752aa1e19bb608f3e97d, < e1e852746997500f1873f60b954da5f02cc2dba3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a critical component of the Linux operating system. It provides the core functionality and acts as an interface between the hardware and software layers. The Kernel package for the arm64 architecture is specifically designed for ARM-based 64-bit systems. It enables virtualization capabilities through the KVM (Kernel-based Virtual Machine) module, allowing users to run multiple virtual machines on a single physical machine. However, a vulnerability has been discovered in the arm64 implementation of KVM that could lead to the consumption of a stale esr (Exception Syndrome Register) value when an SError (System Error) occurs.
Vulnerability Detail
The vulnerability in the arm64 implementation of KVM occurs when an SError is triggered. In such cases, there is a possibility of consuming a stale esr value, which can have unintended consequences. This could potentially lead to incorrect error handling or other security issues. The impact and attack plausibility of this vulnerability have not been proven yet. It is important to note that this vulnerability has been fixed in the Linux Kernel version v5.15.22 by commit e1e852746997500f1873f60b954da5f02cc2dba3. The vulnerability was introduced in version v5.11 by commit defe21f49bc98b095300752aa1e19bb608f3e97d.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The vulnerability in the arm64 implementation of KVM can lead to the consumption of a stale esr value when an SError occurs. It is crucial to update the Linux Kernel to version v5.15.22 or later to mitigate this vulnerability. Failure to do so may result in incorrect error handling or other security issues. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The Kernel package is a critical component of the Linux operating system that provides core functionality and acts as an interface between hardware and software layers.
KVM (Kernel-based Virtual Machine) is a module in the Linux Kernel that enables virtualization capabilities, allowing users to run multiple virtual machines on a single physical machine.
arm64 is an architecture designed for ARM-based 64-bit systems, providing improved performance and efficiency compared to previous ARM architectures.
An SError (System Error) is an exception that occurs in the ARM architecture when a system-level error is detected, such as a memory access violation or an external interrupt.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and the Vulert Playground will analyze it for any open-source vulnerabilities, including this specific vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
