Vulnerability in Kernel: KVM: LAPIC: Also cancel preemption timer during SET_LAPIC
Summary
GSD-2022-1000610: KVM: LAPIC: Also cancel preemption timer during SET_LAPIC. Affects Kernel versions < ce55f63f6cea4cab8ae9212f73285648a5baa30d. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a crucial component of the Linux operating system that provides core functionality and acts as an interface between hardware and software. It manages system resources, facilitates communication between processes, and enables various features and services. The KVM (Kernel-based Virtual Machine) is a module within the Kernel that allows running virtual machines on Linux. The LAPIC (Local Advanced Programmable Interrupt Controller) is responsible for handling interrupts and timers in virtual machines. This vulnerability affects the LAPIC module in the Kernel.
Vulnerability Detail
The vulnerability in the LAPIC module of the Kernel arises from a failure to cancel the preemption timer during the SET_LAPIC operation. This oversight could potentially lead to a security breach or system instability. An attacker may exploit this vulnerability to gain unauthorized access, escalate privileges, or cause a denial-of-service (DoS) condition. The vulnerability was fixed in Linux Kernel version v5.16.5 by commit ce55f63f6cea4cab8ae9212f73285648a5baa30d.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in the Kernel's LAPIC module could potentially lead to unauthorized access, privilege escalation, or a denial-of-service condition. It is crucial to update the Kernel to version v5.16.5 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability could potentially allow an attacker to gain unauthorized access, escalate privileges, or cause a denial-of-service (DoS) condition.
You can use Vulert's playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it in real-time.
Yes, the vulnerability has been fixed in Linux Kernel version v5.16.5 by commit ce55f63f6cea4cab8ae9212f73285648a5baa30d.
As there is no specific workaround mentioned, it is recommended to update the Kernel to the fixed version as soon as possible.
You can find more information about this vulnerability in the Cloud Security Alliance's GSD database (https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1000xxx/GSD-2022-1000610.json).
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
