Incomplete cleanup in Linux kernel - CVE-2022-0171

Vulnerability identifier: #VU68515

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-0171

CWE-ID: CWE-459

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to incomplete cleanup in KVM SEV API. A local non-root (host) user-level application can crash the host kernel by creating a confidential guest VM instance in AMD CPU that supports Secure Encrypted Virtualization (SEV).

Linux kernel
Debian Linux
Amazon Linux AMI
Anolis OS
Slackware Linux
Ubuntu
kernel-modules-extra
bpftool
kernel
kernel-core
kernel-debug
kernel-debug-core
kernel-debug-devel
kernel-debug-modules
kernel-debug-modules-extra
kernel-devel
kernel-headers
kernel-modules
kernel-modules-internal
kernel-tools
kernel-tools-libs
perf
python3-perf
kernel-tools-libs-devel
linux (Debian package)
linux-image-lowlatency-64k (Ubuntu package)
linux-image-lowlatency-hwe-22.04 (Ubuntu package)
linux-image-lowlatency (Ubuntu package)
linux-image-lowlatency-64k-hwe-22.04 (Ubuntu package)
linux-image-virtual (Ubuntu package)
linux-image-generic-64k (Ubuntu package)
linux-image-generic-64k-hwe-22.04 (Ubuntu package)
linux-image-generic-lpae (Ubuntu package)
linux-image-generic-lpae-hwe-22.04 (Ubuntu package)
linux-image-virtual-hwe-22.04 (Ubuntu package)
linux-image-generic (Ubuntu package)
linux-image-generic-hwe-22.04 (Ubuntu package)
linux-image-5.15.0-57-generic-lpae (Ubuntu package)
linux-image-5.15.0-57-lowlatency (Ubuntu package)
linux-image-5.15.0-57-lowlatency-64k (Ubuntu package)
linux-image-5.15.0-57-generic (Ubuntu package)
linux-image-5.15.0-57-generic-64k (Ubuntu package)
linux-image-generic-hwe-20.04 (Ubuntu package)
linux-image-virtual-hwe-20.04 (Ubuntu package)
linux-image-generic-64k-hwe-20.04 (Ubuntu package)
linux-image-generic-lpae-hwe-20.04 (Ubuntu package)
linux-image-gkeop (Ubuntu package)
linux-image-gkeop-5.15 (Ubuntu package)
linux-image-5.15.0-1012-gkeop (Ubuntu package)
linux-image-ibm (Ubuntu package)
linux-image-raspi-nolpae (Ubuntu package)
linux-image-raspi (Ubuntu package)
linux-image-5.15.0-1022-raspi (Ubuntu package)
linux-image-5.15.0-1022-raspi-nolpae (Ubuntu package)
linux-image-5.15.0-1022-ibm (Ubuntu package)
linux-image-gke-5.15 (Ubuntu package)
linux-image-gke (Ubuntu package)
linux-image-5.15.0-1024-gke (Ubuntu package)
linux-image-kvm (Ubuntu package)
linux-image-5.15.0-1025-kvm (Ubuntu package)
linux-image-gcp (Ubuntu package)
linux-image-oracle (Ubuntu package)
linux-image-5.15.0-1026-oracle (Ubuntu package)
linux-image-5.15.0-1026-gcp (Ubuntu package)
linux-image-aws-lts-22.04 (Ubuntu package)
linux-image-aws (Ubuntu package)
linux-image-5.15.0-1027-aws (Ubuntu package)
linux-image-5.15.0-1027-gke (Ubuntu package)
linux-image-azure-lts-22.04 (Ubuntu package)
linux-image-azure (Ubuntu package)
linux-image-5.15.0-1030-azure (Ubuntu package)
linux-image-5.15.0-1030-azure-fde (Ubuntu package)
linux-image-azure-fde (Ubuntu package)
linux-5.15.80/kernel-modules
linux-5.15.80/kernel-huge
linux-5.15.80/kernel-generic
linux-5.15.80/kernel-headers

Install updates from vendor's website.

kernel-modules-extra - addressed in versions 5.10.134-13, 5.10.134-14
bpftool - addressed in versions 5.10.134-13, 5.10.134-14
kernel - addressed in versions 5.10.134-13, 5.10.134-14
kernel-core - addressed in versions 5.10.134-13, 5.10.134-14
kernel-debug - addressed in versions 5.10.134-13, 5.10.134-14
kernel-debug-core - addressed in versions 5.10.134-13, 5.10.134-14
kernel-debug-devel - addressed in versions 5.10.134-13, 5.10.134-14
kernel-debug-modules - addressed in versions 5.10.134-13, 5.10.134-14
kernel-debug-modules-extra - addressed in versions 5.10.134-13, 5.10.134-14
kernel-devel - addressed in versions 5.10.134-13, 5.10.134-14
kernel-headers - addressed in versions 5.10.134-13, 5.10.134-14
kernel-modules - addressed in versions 5.10.134-13, 5.10.134-14
kernel-modules-internal - update to 5.10.134-13
kernel-tools - addressed in versions 5.10.134-13, 5.10.134-14
kernel-tools-libs - addressed in versions 5.10.134-13, 5.10.134-14
perf - addressed in versions 5.10.134-13, 5.10.134-14
python3-perf - addressed in versions 5.10.134-13, 5.10.134-14
kernel-tools-libs-devel - update to 5.10.134-14
linux (Debian package) - update to 5.10.149-1
linux-image-lowlatency-64k (Ubuntu package) - update to 5.15.0.57.50
linux-image-lowlatency-hwe-22.04 (Ubuntu package) - update to 5.15.0.57.50
linux-image-lowlatency (Ubuntu package) - update to 5.15.0.57.50
linux-image-lowlatency-64k-hwe-22.04 (Ubuntu package) - update to 5.15.0.57.50
linux-image-virtual (Ubuntu package) - update to 5.15.0.57.55
linux-image-generic-64k (Ubuntu package) - update to 5.15.0.57.55
linux-image-generic-64k-hwe-22.04 (Ubuntu package) - update to 5.15.0.57.55
linux-image-generic-lpae (Ubuntu package) - update to 5.15.0.57.55
linux-image-generic-lpae-hwe-22.04 (Ubuntu package) - update to 5.15.0.57.55
linux-image-virtual-hwe-22.04 (Ubuntu package) - update to 5.15.0.57.55
linux-image-generic (Ubuntu package) - update to 5.15.0.57.55
linux-image-generic-hwe-22.04 (Ubuntu package) - update to 5.15.0.57.55
linux-image-5.15.0-57-generic-lpae (Ubuntu package) - addressed in versions 5.15.0-57.63, 5.15.0-57.63~20.04.1
linux-image-5.15.0-57-lowlatency (Ubuntu package) - update to 5.15.0-57.63
linux-image-5.15.0-57-lowlatency-64k (Ubuntu package) - update to 5.15.0-57.63
linux-image-5.15.0-57-generic (Ubuntu package) - addressed in versions 5.15.0-57.63, 5.15.0-57.63~20.04.1
linux-image-5.15.0-57-generic-64k (Ubuntu package) - addressed in versions 5.15.0-57.63, 5.15.0-57.63~20.04.1
linux-image-generic-hwe-20.04 (Ubuntu package) - update to 5.15.0.57.63~20.04.23
linux-image-virtual-hwe-20.04 (Ubuntu package) - update to 5.15.0.57.63~20.04.23
linux-image-generic-64k-hwe-20.04 (Ubuntu package) - update to 5.15.0.57.63~20.04.23
linux-image-generic-lpae-hwe-20.04 (Ubuntu package) - update to 5.15.0.57.63~20.04.23
linux-image-gkeop (Ubuntu package) - update to 5.15.0.1012.11
linux-image-gkeop-5.15 (Ubuntu package) - update to 5.15.0.1012.11
linux-image-5.15.0-1012-gkeop (Ubuntu package) - update to 5.15.0-1012.16
linux-image-ibm (Ubuntu package) - update to 5.15.0.1022.18
linux-image-raspi-nolpae (Ubuntu package) - update to 5.15.0.1022.19
linux-image-raspi (Ubuntu package) - update to 5.15.0.1022.19
linux-image-5.15.0-1022-raspi (Ubuntu package) - update to 5.15.0-1022.24
linux-image-5.15.0-1022-raspi-nolpae (Ubuntu package) - update to 5.15.0-1022.24
linux-image-5.15.0-1022-ibm (Ubuntu package) - update to 5.15.0-1022.25
linux-image-gke-5.15 (Ubuntu package) - addressed in versions 5.15.0.1024.23, 5.15.0.1027.32~20.04.1
linux-image-gke (Ubuntu package) - update to 5.15.0.1024.23
linux-image-5.15.0-1024-gke (Ubuntu package) - update to 5.15.0-1024.29
linux-image-kvm (Ubuntu package) - update to 5.15.0.1025.21
linux-image-5.15.0-1025-kvm (Ubuntu package) - update to 5.15.0-1025.30
linux-image-gcp (Ubuntu package) - update to 5.15.0.1026.21
linux-image-oracle (Ubuntu package) - update to 5.15.0.1026.21
linux-image-5.15.0-1026-oracle (Ubuntu package) - update to 5.15.0-1026.32
linux-image-5.15.0-1026-gcp (Ubuntu package) - update to 5.15.0-1026.33
linux-image-aws-lts-22.04 (Ubuntu package) - update to 5.15.0.1027.25
linux-image-aws (Ubuntu package) - addressed in versions 5.15.0.1027.25, 5.15.0.1027.31~20.04.16
linux-image-5.15.0-1027-aws (Ubuntu package) - addressed in versions 5.15.0-1027.31, 5.15.0-1027.31~20.04.1
linux-image-5.15.0-1027-gke (Ubuntu package) - update to 5.15.0-1027.32~20.04.1
linux-image-azure-lts-22.04 (Ubuntu package) - update to 5.15.0.1030.26
linux-image-azure (Ubuntu package) - addressed in versions 5.15.0.1030.26, 5.15.0.1030.37~20.04.20
linux-image-5.15.0-1030-azure (Ubuntu package) - addressed in versions 5.15.0-1030.37, 5.15.0-1030.37~20.04.1
linux-image-5.15.0-1030-azure-fde (Ubuntu package) - update to 5.15.0-1030.37.1
linux-image-azure-fde (Ubuntu package) - update to 5.15.0.1030.37.7
linux-5.15.80/kernel-modules - update to 5.15.80
linux-5.15.80/kernel-huge - update to 5.15.80
linux-5.15.80/kernel-generic - update to 5.15.80
linux-5.15.80/kernel-headers - update to 5.15.80_smp
kernel - update to 6.1.10-15.42

• https://bugzilla.redhat.com/show_bug.cgi?id=2038940
• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=683412ccf61294d727ead4a73d97397396e69a6b
• https://access.redhat.com/security/cve/CVE-2022-0171
• https://www.debian.org/security/2022/dsa-5257

• Denial of service in Linux kernel KVM SEV API
• Debian update for linux
• Slackware Linux update for kernel
• Ubuntu update for linux
• Ubuntu update for linux-aws
• Ubuntu update for linux-gke-5.15
• Amazon Linux AMI update for kernel
• Anolis OS update for kernel
• Anolis OS update for kernel