CVE-2022-48793

What it actually does

The flaw causes a NULL pointer dereference in KVM x86 nSVM nested migration because nested_svm_load_cr3 is invoked before nested NPT is enabled, preventing proper initialization of walk_mmu and guest memory access.

Why it matters to the business

Unpatched Linux systems running KVM with nested virtualization may experience guest or host crashes during VM migration, leading to downtime and potential data loss in virtualized environments.

How an attack unfolds

An attacker with local access triggers a nested SVM migration sequence in KVM; the premature CR3 load occurs before NPT setup, dereferencing an uninitialized pointer and causing a kernel panic.

How to fix it

Upgrade the Linux kernel to a version containing commit 74b426bea4f7e3b081add2b88d4fba16d3af7ab6 or later stable releases that include the fix for this nested migration ordering issue.

How to confirm the fix worked

Verify the running kernel includes commit 74b426bea4f7e3b081add2b88d4fba16d3af7ab6; test nested SVM migration operations to confirm no NULL dereference occurs and walk_mmu initializes correctly.

Typical attack path

1. Obtain local access on a host running vulnerable KVM with nSVM enabled
2. Configure or trigger a nested guest migration operation
3. Cause the migration path to execute nested_svm_load_cr3 before NPT activation
4. Trigger the NULL dereference resulting in a kernel crash

How to detect it

Review kernel logs for oops or panic entries referencing KVM, nSVM, or nested_svm_load_cr3 during migration events; examine dmesg or journalctl for walk_mmu initialization failures.

What your security team should do

• Prioritize kernel updates on all hosts using KVM nested virtualization
• Disable nested SVM if migration functionality is not required until patched
• Monitor for kernel oops or panic reports related to KVM nSVM during migrations