CVE-2022-3344 - Vulnerability Details - OpenCVE

A flaw was found in the KVM's AMD nested virtualization (SVM). A malicious L1 guest could purposely fail to intercept the shutdown of a cooperative nested guest (L2), possibly leading to a page fault and kernel panic in the host (L0).

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Linux	Linux Kernel

Configuration 1 [-]

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://bugzilla.redhat.com/show_bug.cgi?id=2130278
https://lore.kernel.org/lkml/20221020093055.224317-5-mlevitsk%40redhat.com/T/
https://nvd.nist.gov/vuln/detail/CVE-2022-3344
https://www.cve.org/CVERecord?id=CVE-2022-3344

History

No history.

MITRE

Status: PUBLISHED

Assigner: redhat

Published: 2022-10-24T00:00:00

Updated: 2024-08-03T01:07:06.537Z

Reserved: 2022-09-27T00:00:00

Link: CVE-2022-3344

Vulnrichment

No data.

NVD

Status : Modified

Published: 2022-10-25T17:15:57.087

Modified: 2024-11-21T07:19:20.367

Link: CVE-2022-3344

Redhat

Severity : Low

Publid Date: 2022-10-20T00:00:00Z

Links: CVE-2022-3344 - Bugzilla

{"acknowledgement": "This issue was discovered by Maxim Levitsky (Red Hat).", "bugzilla": {"description": "kernel: KVM: SVM: nested shutdown interception could lead to host crash", "id": "2130278", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2130278"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-440", "details": ["A flaw was found in the KVM's AMD nested virtualization (SVM). A malicious L1 guest could purposely fail to intercept the shutdown of a cooperative nested guest (L2), possibly leading to a page fault and kernel panic in the host (L0).", "A flaw was found in the KVM's AMD nested virtualization (SVM). A malicious L1 guest could purposely fail to intercept the shutdown of a cooperative nested guest (L2), possibly leading to a page fault and kernel panic in the host (L0)."], "mitigation": {"lang": "en:us", "value": "This vulnerability can be mitigated by disabling the nested virtualization feature:\n```\n# modprobe -r kvm_amd\n# modprobe kvm_amd nested=0\n```"}, "name": "CVE-2022-3344", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2022-10-20T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2022-3344\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-3344"], "statement": "Red Hat currently provides the nested virtualization feature as a Technology Preview. Nested virtualization is therefore unsupported for production use. For more information please refer to https://access.redhat.com/solutions/21101 and https://access.redhat.com/support/offerings/techpreview.", "threat_severity": "Low"}