CVE-2022-48700
Assigner: Linux
Published: 2024-05-03T15:12:16.246Z
State: PUBLISHED
descriptions: value: In the Linux kernel, the following vulnerability has been resolved:

vfio/type1: Unpin zero pages

There's currently a reference count leak on the zero page.  We increment
the reference via pin_user_pages_remote(), but the page is later handled
as an invalid/reserved page, therefore it's not accounted against the
user and not unpinned by our put_pfn().

Introducing special zero page handling in put_pfn() would resolve the
leak, but without accounting of the zero page, a single user could
still create enough mappings to generate a reference count overflow.

The zero page is always resident, so for our purposes there's no reason
to keep it pinned.  Therefore, add a loop to walk pages returned from
pin_user_pages_remote() and unpin any zero pages.
affected: product: Linux
vendor: Linux
defaultStatus: unaffected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions: version: 1da177e4c3f4
lessThan: 578d644edc7d
status: affected
versionType: git
version: 1da177e4c3f4
lessThan: 5321908ef74f
status: affected
versionType: git
version: 1da177e4c3f4
lessThan: 5d721bf22293
status: affected
versionType: git
version: 1da177e4c3f4
lessThan: 873aefb376bb
status: affected
versionType: git
product: Linux
vendor: Linux
defaultStatus: affected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions: version: 5.10.146
lessThanOrEqual: 5.10.*
status: unaffected
versionType: custom
version: 5.15.68
lessThanOrEqual: 5.15.*
status: unaffected
versionType: custom
version: 5.19.9
lessThanOrEqual: 5.19.*
status: unaffected
versionType: custom
version: 6.0
lessThanOrEqual: *
status: unaffected
versionType: original_commit_for_fix
title: vfio/type1: Unpin zero pages
x_generator: engine: bippy-d175d3acf727