CVE-2022-1158

What it actually does

Improper use of vm_pgoff as page offset during KVM guest page table entry updates allows a local user-controlled vaddr to write outside the intended userspace region, enabling kernel memory corruption via a use-after-free condition.

Why it matters to the business

Unprivileged local accounts on virtualization hosts can crash the kernel or corrupt memory, causing denial of service for all guests and host services; high ecosystem prevalence in Linux distributions increases exposure across data centers and cloud infrastructure.

How an attack unfolds

An attacker with local unprivileged access on a host running KVM maps a controlled virtual address and manipulates vm_pgoff during guest page table updates to trigger an out-of-bounds write that corrupts kernel structures, leading to a use-after-free that can be leveraged for denial of service.

How to fix it

Upgrade the Linux kernel on all affected hosts to a version containing the fix for this KVM page table handling flaw; apply vendor updates for Fedora and Red Hat Enterprise Linux as they become available.

How to confirm the fix worked

Confirm kernel versions are newer than the vulnerable releases listed by the distribution; review KVM source for correct handling of vm_pgoff versus vaddr offsets in page table updates; run regression tests that exercise guest page table modifications.

Typical attack path

1. Obtain local unprivileged shell on KVM host
2. Create or attach to a guest VM and map user-controlled vaddr
3. Trigger KVM page table entry update path with crafted vm_pgoff
4. Cause out-of-bounds write and subsequent use-after-free in kernel
5. Crash host kernel to achieve denial of service

How to detect it

Review kernel logs and audit records for unexpected KVM page table update failures or host kernel oops/panics originating from page table handling code; correlate with local user sessions on virtualization hosts.

What your security team should do

• Prioritize kernel updates on all virtualization hosts within the next patching cycle
• Restrict local user access on hosts where possible until patches are applied
• Monitor for new fixed kernel packages from Red Hat and Fedora
• Audit systems for the presence of the vulnerable KVM code paths