{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2022-49557", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-02-26T02:08:31.591Z", "datePublished": "2025-02-26T02:14:04.090Z", "dateUpdated": "2026-08-05T08:55:42.945Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:55:42.945Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/fpu: KVM: Set the base guest FPU uABI size to sizeof(struct kvm_xsave)\n\nSet the starting uABI size of KVM's guest FPU to 'struct kvm_xsave',\ni.e. to KVM's historical uABI size. When saving FPU state for usersapce,\nKVM (well, now the FPU) sets the FP+SSE bits in the XSAVE header even if\nthe host doesn't support XSAVE. Setting the XSAVE header allows the VM\nto be migrated to a host that does support XSAVE without the new host\nhaving to handle FPU state that may or may not be compatible with XSAVE.\n\nSetting the uABI size to the host's default size results in out-of-bounds\nwrites (setting the FP+SSE bits) and data corruption (that is thankfully\ncaught by KASAN) when running on hosts without XSAVE, e.g. on Core2 CPUs.\n\nWARN if the default size is larger than KVM's historical uABI size; all\nfeatures that can push the FPU size beyond the historical size must be\nopt-in.\n\n ==================================================================\n BUG: KASAN: slab-out-of-bounds in fpu_copy_uabi_to_guest_fpstate+0x86/0x130\n Read of size 8 at addr ffff888011e33a00 by task qemu-build/681\n CPU: 1 PID: 681 Comm: qemu-build Not tainted 5.18.0-rc5-KASAN-amd64 #1\n Hardware name: /DG35EC, BIOS ECG3510M.86A.0118.2010.0113.1426 01/13/2010\n Call Trace:\n \n dump_stack_lvl+0x34/0x45\n print_report.cold+0x45/0x575\n kasan_report+0x9b/0xd0\n fpu_copy_uabi_to_guest_fpstate+0x86/0x130\n kvm_arch_vcpu_ioctl+0x72a/0x1c50 [kvm]\n kvm_vcpu_ioctl+0x47f/0x7b0 [kvm]\n __x64_sys_ioctl+0x5de/0xc90\n do_syscall_64+0x31/0x50\n entry_SYSCALL_64_after_hwframe+0x44/0xae\n \n Allocated by task 0:\n (stack is not available)\n The buggy address belongs to the object at ffff888011e33800\n which belongs to the cache kmalloc-512 of size 512\n The buggy address is located 0 bytes to the right of\n 512-byte region [ffff888011e33800, ffff888011e33a00)\n The buggy address belongs to the physical page:\n page:0000000089cd4adb refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11e30\n head:0000000089cd4adb order:2 compound_mapcount:0 compound_pincount:0\n flags: 0x4000000000010200(slab|head|zone=1)\n raw: 4000000000010200 dead000000000100 dead000000000122 ffff888001041c80\n raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000\n page dumped because: kasan: bad access detected\n Memory state around the buggy address:\n ffff888011e33900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n ffff888011e33980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n >ffff888011e33a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n ^\n ffff888011e33a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n ffff888011e33b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n ==================================================================\n Disabling lock debugging due to kernel taint" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The bug is reached only through local KVM vCPU ioctls (KVM_SET_XSAVE / KVM_GET_XSAVE2) on a fd obtained via /dev/kvm → KVM_CREATE_VM → KVM_CREATE_VCPU; it is not reachable from network packets or guest hypercalls.\nAC:L - On a host without XSAVE (legacy CPUs, noxsave, or Xen PV clearing XSAVE), a VMM that owns the vCPU fd can deterministically trigger the undersized kmalloc-512 path and the adjacent 8-byte OOB access with no race or other attacker-uncontrollable condition.\nPR:L - The ioctl path has no CAP_SYS_ADMIN check; access is gated by opening /dev/kvm and holding VM/vCPU fds, which is commonly available to non-root kvm-group or seat-uaccess users rather than requiring real host root.\nUI:N - The attacker issues KVM_SET_XSAVE/KVM_GET_XSAVE2 on fds they control; no separate victim action is required.\nS:U - This is a host userspace-to-host-kernel KVM ioctl memory-corruption path, not a guest-to-host escape; impact stays within the same host kernel security authority.\nC:H - KVM_SET_XSAVE performs a slab-out-of-bounds read of adjacent heap, and KVM_GET_XSAVE2 corrupts adjacent slab with an OOB write; per guidance, OOB/memory-corruption primitives are High confidentiality impact.\nI:H - fpu_copy_guest_fpstate_to_uabi writes XFEATURE_MASK_FPSSE past the end of the uabi_size-sized buffer on KVM_GET_XSAVE2, which is a slab out-of-bounds write scored as High integrity impact.\nA:H - The demonstrated KASAN slab-out-of-bounds fault and resulting adjacent-object data corruption can oops/panic the kernel, so availability impact is High." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "arch/x86/kernel/fpu/core.c" ], "versions": [ { "version": "c60427dd50ba9b20063ccaed0e98d62e886d7a3b", "lessThan": "9cf15ebb7dedfe2f27120743b8ea8441c99ac73c", "status": "affected", "versionType": "git" }, { "version": "c60427dd50ba9b20063ccaed0e98d62e886d7a3b", "lessThan": "c181acbd1a427859d5fda543b95fbae28f7f6068", "status": "affected", "versionType": "git" }, { "version": "c60427dd50ba9b20063ccaed0e98d62e886d7a3b", "lessThan": "d187ba5312307d51818beafaad87d28a7d939adf", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "arch/x86/kernel/fpu/core.c" ], "versions": [ { "version": "5.17", "status": "affected" }, { "version": "0", "lessThan": "5.17", "status": "unaffected", "versionType": "semver" }, { "version": "5.17.13", "lessThanOrEqual": "5.17.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.18.2", "lessThanOrEqual": "5.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.19", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "5.17.13" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "5.18.2" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "5.19" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/9cf15ebb7dedfe2f27120743b8ea8441c99ac73c" }, { "url": "https://git.kernel.org/stable/c/c181acbd1a427859d5fda543b95fbae28f7f6068" }, { "url": "https://git.kernel.org/stable/c/d187ba5312307d51818beafaad87d28a7d939adf" } ], "title": "x86/fpu: KVM: Set the base guest FPU uABI size to sizeof(struct kvm_xsave)", "x_generator": { "engine": "bippy-1.2.0" } } } }