ACK: [SRU][J][PATCH 0/1] CVE-2022-49562

[Edoardo Canepa]

Acked-by: Edoardo Canepa <edoardo.canepa at canonical.com>

On 9/9/26 15:57, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2022-49562
>
> [ Impact ]
>
> In the Linux kernel, the following vulnerability has been resolved:
>
> KVM: x86: Use __try_cmpxchg_user() to update guest PTE A/D bits
>
> Use the recently introduced __try_cmpxchg_user() to update guest PTE A/D bits
> instead of mapping the PTE into kernel address space. The VM_PFNMAP path is
> broken as it assumes that vm_pgoff is the base pfn of the mapped VMA range,
> which is conceptually wrong as vm_pgoff is the offset relative to the file and
> has nothing to do with the pfn. The horrific hack worked for the original use
> case (backing guest memory with /dev/mem), but leads to accessing "random"
> pfns for pretty much any other VM_PFNMAP case.
>
> [ Fix ]
>
> jammy/linux: backported from f122dfe44768
>
> [ Test Plan ]
>
> Build and boot tested.
>
> [ Where Problems Could Occur ]
>
> This change only affects the x86 KVM shadow paging path that updates guest
> page-table accessed/dirty bits, so any regression would show up on x86 hosts
> running KVM guests, in particular guests whose memory is backed by VM_PFNMAP
> mappings such as /dev/mem or device pass-through regions. A faulty fix could
> cause incorrect A/D bit accounting or guest instability. Non-x86 systems,
> hosts not running KVM, and workloads that do not use virtualization are not
> affected.
>
> [ Other Info ]
>
> Kybele flow-v11-25-ga27c0fa6. Reference: c5b40671/v1
>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260914/93f0b31e/attachment-0001.sig>