CVE-2022-49562 in Linux
Summary
by MITRE • 02/26/2025
In the Linux kernel, the following vulnerability has been resolved:
KVM: x86: Use __try_cmpxchg_user() to update guest PTE A/D bits
Use the recently introduced __try_cmpxchg_user() to update guest PTE A/D bits instead of mapping the PTE into kernel address space. The VM_PFNMAP path is broken as it assumes that vm_pgoff is the base pfn of the mapped VMA range, which is conceptually wrong as vm_pgoff is the offset relative to the file and has nothing to do with the pfn. The horrific hack worked for the original use case (backing guest memory with /dev/mem), but leads to accessing "random" pfns for pretty much any other VM_PFNMAP case.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/23/2025
The vulnerability described in CVE-2022-49562 resides within the Linux kernel's KVM virtualization subsystem, specifically affecting x86 architecture implementations. This issue manifests in the handling of guest page table entry access and dirty bits, which are critical components for memory management and virtualization operations. The flaw impacts how the kernel updates PTE (Page Table Entry) accessed and dirty bits when managing guest virtual memory mappings, creating a potential security risk that could be exploited to gain unauthorized access to memory regions or compromise the integrity of virtualized environments.
The technical root cause of this vulnerability stems from an improper implementation approach in the KVM subsystem's memory management code. The original implementation incorrectly used the VM_PFNMAP path to update guest PTE A/D bits by mapping the page table entry into kernel address space. This approach fundamentally misunderstood the relationship between vm_pgoff and physical frame numbers within the virtual memory management system. The vm_pgoff field represents an offset relative to a backing file rather than a base physical frame number, making the assumption that it can be directly used as a pfn invalid and dangerous. This conceptual error led to the system attempting to access random physical frame numbers when processing various VM_PFNMAP scenarios, rather than correctly identifying the intended memory regions.
The operational impact of this vulnerability extends beyond simple memory management issues, as it creates potential pathways for privilege escalation and memory corruption within virtualized environments. When the kernel attempts to update guest PTE A/D bits using the flawed VM_PFNMAP approach, it may inadvertently access memory locations that were not intended for modification, potentially leading to information disclosure, denial of service conditions, or even arbitrary code execution within the hypervisor context. This risk is particularly severe in cloud computing and server virtualization environments where multiple tenants share the same physical hardware, as it could allow one guest to potentially access or corrupt another guest's memory space. The vulnerability affects systems running Linux kernels that implement KVM virtualization with x86 architecture support, making it relevant to a substantial portion of server and cloud infrastructure deployments.
The resolution for CVE-2022-49562 involves replacing the problematic implementation with the newly introduced __try_cmpxchg_user() function, which provides a more secure and correct method for updating guest PTE A/D bits. This change addresses the fundamental misunderstanding of the vm_pgoff field's semantics and eliminates the dangerous memory access patterns that were present in the original implementation. The fix aligns with established security principles by using proper kernel APIs designed for user space memory operations rather than attempting to directly map and manipulate kernel virtual memory addresses. Organizations should prioritize applying this patch as it represents a direct correction to a memory management flaw that could have been exploited to compromise virtualization security boundaries. The vulnerability demonstrates the importance of proper kernel memory management practices and highlights the risks associated with incorrect assumptions about virtual memory subsystem components, particularly when dealing with complex hypervisor implementations that must maintain strict isolation between virtual machines.
This vulnerability relates to CWE-121, which addresses stack buffer overflow conditions, and CWE-122, concerning heap buffer overflow conditions, as the improper memory access patterns could lead to memory corruption issues. The attack surface aligns with ATT&CK technique T1059.001 for command and scripting interpreter, where an attacker might exploit the memory corruption to execute malicious code, and T1068 for local privilege escalation, as the vulnerability could be leveraged to gain elevated privileges within the virtualized environment. The fix implements proper kernel security practices by utilizing the correct kernel APIs for memory operations and avoiding dangerous direct virtual memory manipulation patterns that could lead to unauthorized memory access or modification.