Log in Start free

Vulnerability · Published Oct 21, 2024 · Assigned by Linux

CVE-2022-48991mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths

High 8.8

In plain English

A high-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.3%top 83.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths Any codepath that zaps page table entries must invoke MMU notifiers to ensure that secondary MMUs (like KVM) don't keep accessing pages which aren't mapped anymore. Secondary MMUs don't hold their own references to pages that are mirrored over, so failing to notify them can lead to page use-after-free. I'm marking this as addressing an issue introduced in commit f3f0e1d2150b ("khugepaged: add support of collapse for tmpfs/shmem pages"), but most of the security impact of this only came in commit 27e1f8273113 ("khugepaged: enable collapse pmd for pte-mapped THP"), which actually omitted flushes for the removal of present PTEs, not just for the removal of empty page tables.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux6.1.4-1DEBIAN-CVE-2022-48991
Debian:13linux6.1.4-1DEBIAN-CVE-2022-48991
Debian:14linux6.1.4-1DEBIAN-CVE-2022-48991
Ubuntu:22.04:LTSlinux5.15.0-67.74UBUNTU-CVE-2022-48991
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2022-48991
Ubuntu:22.04:LTSlinux-aws5.15.0-1031.35UBUNTU-CVE-2022-48991
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2022-48991
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2022-48991
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2022-48991
Ubuntu:22.04:LTSlinux-azure5.15.0-1034.41UBUNTU-CVE-2022-48991
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2022-48991
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2022-48991
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2022-48991
Ubuntu:22.04:LTSlinux-azure-fde5.15.0-1034.41.1UBUNTU-CVE-2022-48991
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2022-48991
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2022-48991
Ubuntu:22.04:LTSlinux-gcp5.15.0-1030.37UBUNTU-CVE-2022-48991
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2022-48991
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2022-48991
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2022-48991
Ubuntu:22.04:LTSlinux-gke5.15.0-1028.33UBUNTU-CVE-2022-48991
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1016.21UBUNTU-CVE-2022-48991
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2022-48991
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2022-48991
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2022-48991
Ubuntu:22.04:LTSlinux-ibm5.15.0-1026.29UBUNTU-CVE-2022-48991
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1026.31UBUNTU-CVE-2022-48991
Ubuntu:22.04:LTSlinux-kvm5.15.0-1029.34UBUNTU-CVE-2022-48991
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-67.74UBUNTU-CVE-2022-48991
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2022-48991
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2022-48991
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2022-48991
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1023.23UBUNTU-CVE-2022-48991
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2022-48991
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2022-48991
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2022-48991
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2022-48991
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2022-48991
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2022-48991
Ubuntu:22.04:LTSlinux-oracle5.15.0-1030.36UBUNTU-CVE-2022-48991
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2022-48991
Ubuntu:22.04:LTSlinux-raspi5.15.0-1025.27UBUNTU-CVE-2022-48991
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2022-48991
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2022-48991
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2022-48991
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2022-48991
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2022-48991
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2022-48991
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2022-48991
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2022-48991

Affected products (as reported)

VendorProductVersions
Linux Linux f3f0e1d2150b2b99da2cbdfaad000089efe9bf30 – before 275c626c131cfe141beeb6c575e31fa53d32da19f3f0e1d2150b2b99da2cbdfaad000089efe9bf30 – before c23105673228c349739e958fa33955ed8faddcaff3f0e1d2150b2b99da2cbdfaad000089efe9bf30 – before ff2a1a6f869650aec99e9d070b5ab625bfbc5bc3f3f0e1d2150b2b99da2cbdfaad000089efe9bf30 – before 5ffc2a75534d9d74d49760f983f8eb675fa63d69f3f0e1d2150b2b99da2cbdfaad000089efe9bf30 – before 7f445ca2e0e59c7971d0b7b853465e50844ab596f3f0e1d2150b2b99da2cbdfaad000089efe9bf30 – before 1a3f8c6cd29d9078cc81b29d39d0e9ae1d6a03c3f3f0e1d2150b2b99da2cbdfaad000089efe9bf30 – before 5450535901d89a5dcca5fbbc59a24fe89caeb465f3f0e1d2150b2b99da2cbdfaad000089efe9bf30 – before f268f6cf875f3220afc77bdd0bf1bb136eb54db9
Linux Linux 4.8

References