linux-cve-announce - CVE-2022-49219: vfio/pci: fix memory leak during D3hot to D0 transition

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025022621-CVE-2022-49219-3b9b@gregkh>
Date: Wed, 26 Feb 2025 02:57:04 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2022-49219: vfio/pci: fix memory leak during D3hot to D0 transition

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

vfio/pci: fix memory leak during D3hot to D0 transition

If 'vfio_pci_core_device::needs_pm_restore' is set (PCI device does
not have No_Soft_Reset bit set in its PMCSR config register), then
the current PCI state will be saved locally in
'vfio_pci_core_device::pm_save' during D0->D3hot transition and same
will be restored back during D3hot->D0 transition.
For saving the PCI state locally, pci_store_saved_state() is being
used and the pci_load_and_free_saved_state() will free the allocated
memory.

But for reset related IOCTLs, vfio driver calls PCI reset-related
API's which will internally change the PCI power state back to D0. So,
when the guest resumes, then it will get the current state as D0 and it
will skip the call to vfio_pci_set_power_state() for changing the
power state to D0 explicitly. In this case, the memory pointed by
'pm_save' will never be freed. In a malicious sequence, the state changing
to D3hot followed by VFIO_DEVICE_RESET/VFIO_DEVICE_PCI_HOT_RESET can be
run in a loop and it can cause an OOM situation.

This patch frees the earlier allocated memory first before overwriting
'pm_save' to prevent the mentioned memory leak.

The Linux kernel CVE team has assigned CVE-2022-49219 to this issue.

Affected and fixed versions
===========================

	Issue introduced in 5.1 with commit 51ef3a004b1eb6241e56b3aa8495769a092a4dc2 and fixed in 5.15.33 with commit 4319f17fb8264ba39352b611dfa913a4d8c1d1a0
	Issue introduced in 5.1 with commit 51ef3a004b1eb6241e56b3aa8495769a092a4dc2 and fixed in 5.16.19 with commit 26ddd196e9eb264da8e1bdc4df8a94d62581c8b5
	Issue introduced in 5.1 with commit 51ef3a004b1eb6241e56b3aa8495769a092a4dc2 and fixed in 5.17.2 with commit c8a1f8bd586ee31020614b8d48b702ece3e2ae44
	Issue introduced in 5.1 with commit 51ef3a004b1eb6241e56b3aa8495769a092a4dc2 and fixed in 5.18 with commit eadf88ecf6ac7d6a9f47a76c6055d9a1987a8991

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2022-49219
will be updated if fixes are backported, please check that for the most
up to date information about this issue.

Affected files
==============

The file(s) affected by this issue are:
	drivers/vfio/pci/vfio_pci_core.c

Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/4319f17fb8264ba39352b611dfa913a4d8c1d1a0
	https://git.kernel.org/stable/c/26ddd196e9eb264da8e1bdc4df8a94d62581c8b5
	https://git.kernel.org/stable/c/c8a1f8bd586ee31020614b8d48b702ece3e2ae44
	https://git.kernel.org/stable/c/eadf88ecf6ac7d6a9f47a76c6055d9a1987a8991