A flaw was found in KVM. When updating a guest's page table entry, vm_pgoff was improperly used as the offset to get the page's pfn. As vaddr and vm_pgoff are controllable by user-mode processes, this flaw allows unprivileged local users on the host to write outside the userspace region and potentially corrupt the kernel, resulting in a denial of service condition.
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
| Link | Tags |
|---|---|
| https://bugzilla.redhat.com/show_bug.cgi?id=2069793 | issue tracking exploit third party advisory |
| https://www.openwall.com/lists/oss-security/2022/04/08/4 | mailing list exploit third party advisory |
| https://security.netapp.com/advisory/ntap-20230214-0003/ | third party advisory |