A security vulnerability, identified as CVE-2022-2153, has been discovered in the Linux kernel’s KVM (Kernel-based Virtual Machine) hypervisor component, specifically when handling a SynIC IRQ. This vulnerability allows an unprivileged local attacker to cause a denial of service (DoS) on the host by executing specific ioctl calls, leading to a NULL pointer dereference and subsequent kernel oops.

In this article, we will explore the details of this vulnerability and the affected systems, examine the exploit code, and review the information on how to mitigate this issue, as well as links to the original references.

Vulnerability Details

CVE-2022-2153 is a flaw introduced in the Linux kernel’s KVM when processing attempts to set a SynIC interrupt request. This issue is caused by the fact that KVM does not correctly handle a situation in which a misbehaving virtual machine monitor (VMM) writes to SYNIC/STIMER model-specific registers (MSRs). Consequently, a NULL pointer dereference occurs, leading to a kernel oops.

Affected Systems

The vulnerability affects Linux kernel versions 4.13 and above, running on systems with KVM and either Intel or AMD x86 virtualization support enabled. It also impacts both 32-bit and 64-bit architectures.

Exploit Details

The exploit takes advantage of the vulnerable KVM code to trigger the NULL pointer dereference when malicious VMMs attempt to use specific ioctl calls. By executing these calls, an unprivileged local attacker can cause a kernel oops, resulting in a denial of service condition on the host.

Here is an example of a malicious code snippet that demonstrates how the exploit may work

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/ioctl.h>

#define KVM_DEV_PATH "/dev/kvm"

int main() {
    int kvm_fd;
    int ret;

    kvm_fd = open(KVM_DEV_PATH, O_RDWR);
    if (kvm_fd == -1) {
        perror("Failed to open KVM device");
        return EXIT_FAILURE;
    }

    ret = ioctl(kvm_fd, MALICIOUS_IOCTL_CALL);
    if (ret == -1) {
        perror("Failed to issue malicious IOCTL call");
        return EXIT_FAILURE;
    }

    close(kvm_fd);
    return EXIT_SUCCESS;
}

The MALICIOUS_IOCTL_CALL in the code snippet above represents the specific ioctl call needed to trigger the vulnerability. However, this particular call has been intentionally omitted to prevent misuse.

Mitigation

To mitigate the CVE-2022-2153 vulnerability, you should apply the appropriate patches provided by your Linux distribution. Additionally, carefully inspect your virtual machine environments and ensure that unprivileged users do not have access to critical resources.

For more information on CVE-2022-2153, please refer to the following resources

1. Official CVE Details: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2153
2. Linux Kernel Patch: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=COMMIT_HASH
3. Linux Kernel Mailing List discussion: https://lore.kernel.org/lkml/THREAD_ID/

Conclusion

CVE-2022-2153 represents a significant security risk for systems running Linux kernels with KVM support. It is crucial for administrators to apply the available patches and monitor systems for any unauthorized access to prevent possible exploitation of this vulnerability. Adopting a proactive approach to system security, staying up to date with vulnerability disclosures, and maintaining a robust patch management process will help protect your infrastructure from increasingly sophisticated attacks.

Timeline

Published on: 08/31/2022 16:15:00 UTC
Last modified on: 11/21/2022 19:45:00 UTC