Skip to content
OpenAdvisories
High · 7.3 CVE-2022-48727 EUVD-2022-53606GHSA-hhpm-mjg9-jj2m

KVM: arm64: Avoid consuming a stale esr value when SError occur

Published Jun 20, 2024 · Updated Aug 5, 2026 · Assigned by Linux

Vendor: Linux Product: Linux Package: linux Package: linux-allwinner-5.19 Package: linux-aws-5.0 Package: linux-aws-5.11 Package: linux-aws-5.13 Package: linux-aws-5.19 Package: linux-aws-5.3 Package: linux-aws-5.8 Package: linux-aws-6.2 Package: linux-azure Package: linux-azure-5.11 Package: linux-azure-5.13 Package: linux-azure-5.19 Package: linux-azure-5.3 Package: linux-azure-5.8 Package: linux-azure-6.2 Package: linux-azure-edge Package: linux-azure-fde Package: linux-azure-fde-5.19 Package: linux-azure-fde-6.2 Package: linux-gcp Package: linux-gcp-5.11 Package: linux-gcp-5.13 Package: linux-gcp-5.19 Package: linux-gcp-5.3 Package: linux-gcp-5.8 Package: linux-gcp-6.2 Package: linux-gke Package: linux-gke-4.15 Package: linux-gke-5.15 Package: linux-gke-5.4 Package: linux-gkeop-5.4 Package: linux-hwe Package: linux-hwe-5.11 Package: linux-hwe-5.13 Package: linux-hwe-5.19 Package: linux-hwe-5.8 Package: linux-hwe-6.2 Package: linux-hwe-edge Package: linux-intel-5.13 Package: linux-intel-iot-realtime Package: linux-intel-iotg-5.15 Package: linux-lowlatency-hwe-5.19 Package: linux-lowlatency-hwe-6.2 Package: linux-nvidia-6.2 Package: linux-oem Package: linux-oem-5.10 Package: linux-oem-5.13 Package: linux-oem-5.14 Package: linux-oem-5.17 Package: linux-oem-5.6 Package: linux-oem-6.0 Package: linux-oem-6.1 Package: linux-oracle-5.0 Package: linux-oracle-5.11 Package: linux-oracle-5.13 Package: linux-oracle-5.3 Package: linux-oracle-5.8 Package: linux-raspi-realtime Package: linux-raspi2 Package: linux-realtime Package: linux-riscv Package: linux-riscv-5.11 Package: linux-riscv-5.19 Package: linux-riscv-5.8 Package: linux-starfive-5.19 Package: linux-starfive-6.2 Platform: Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: Avoid consuming a stale esr value when SError occur

When any exception other than an IRQ occurs, the CPU updates the ESR_EL2
register with the exception syndrome. An SError may also become pending,
and will be synchronised by KVM. KVM notes the exception type, and whether
an SError was synchronised in exit_code.

When an exception other than an IRQ occurs, fixup_guest_exit() updates
vcpu->arch.fault.esr_el2 from the hardware register. When an SError was
synchronised, the vcpu esr value is used to determine if the exception
was due to an HVC. If so, ELR_EL2 is moved back one instruction. This
is so that KVM can process the SError first, and re-execute the HVC if
the guest survives the SError.

But if an IRQ synchronises an SError, the vcpu's esr value is stale.
If the previous non-IRQ exception was an HVC, KVM will corrupt ELR_EL2,
causing an unrelated guest instruction to be executed twice.

Check ARM_EXCEPTION_CODE() before messing with ELR_EL2, IRQs don't
update this register so don't need to check.

Affected products

VendorProductAffectedFixed
Linux Linux 5.11 5.15.22

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 linux 5.16.10-1 —
Debian 13 linux 5.16.10-1 —
Debian 12 linux 5.16.10-1 —
ReleasePackageFixed inAdvisory
Ubuntu 24.04 LTS linux-raspi-realtime No fix yet —
Ubuntu 22.04 LTS linux-riscv +22 No fix yet —
Ubuntu 20.04 LTS linux-gke +26 No fix yet —
Ubuntu 20.04 LTS linux-intel-iotg-5.15 5.15.0-1008.11~20.04.1 —
Ubuntu 18.04 LTS linux-gcp +14 No fix yet —
Ubuntu 16.04 LTS linux-hwe-edge No fix yet —
ReleasePackageFixed inAdvisory
SLES 15 SP5 kernel-64kb +5 5.14.21-150500.55.73.1 SUSE-SU-2024:2939-1
SLES 15 SP5 kernel-azure +2 5.14.21-150500.33.60.1 SUSE-SU-2024:2372-1
SLES 15 SP5 kernel-default-base 5.14.21-150500.55.73.1.150500.6.33.8 SUSE-SU-2024:2939-1
SLES 15 SP5 kernel-docs 5.14.21-150500.55.73.2 SUSE-SU-2024:2939-1
SLES 15 SP4 kernel-64kb +6 5.14.21-150400.24.128.1 SUSE-SU-2024:2929-1
SLES 15 SP4 kernel-default-base 5.14.21-150400.24.128.1.150400.24.62.1 SUSE-SU-2024:2929-1
Show 10 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP4 kernel-default-base 5.14.21-150400.24.128.1.150400.24.62.1 SUSE-SU-2024:2929-1
SLES for SAP 15 SP4 kernel-docs +4 5.14.21-150400.24.128.1 SUSE-SU-2024:2929-1
SLE Micro 5.5 kernel-default 5.14.21-150500.55.73.1 SUSE-SU-2024:2939-1
SLE Micro 5.5 kernel-default-base 5.14.21-150500.55.73.1.150500.6.33.8 SUSE-SU-2024:2939-1
SLE Micro 5.5 kernel-rt +1 5.14.21-150500.13.61.1 SUSE-SU-2024:2394-1
SLE Micro 5.4 kernel-default 5.14.21-150400.24.128.1 SUSE-SU-2024:2929-1
SLE Micro 5.4 kernel-default-base 5.14.21-150400.24.128.1.150400.24.62.1 SUSE-SU-2024:2929-1
SLE Micro 5.4 kernel-rt +1 5.14.21-150400.15.88.1 SUSE-SU-2024:2902-1
SLE Micro 5.3 kernel-default 5.14.21-150400.24.128.1 SUSE-SU-2024:2929-1
SLE Micro 5.3 kernel-default-base 5.14.21-150400.24.128.1.150400.24.62.1 SUSE-SU-2024:2929-1
SLE Micro 5.3 kernel-rt +1 5.14.21-150400.15.88.1 SUSE-SU-2024:2902-1
SLE Live Patching 15 SP5 kernel-default 5.14.21-150500.55.73.1 SUSE-SU-2024:2939-1
SLE Live Patching 15 SP5 kernel-livepatch-SLE15-SP5_Update_17 +1 1-150500.11.3.1 SUSE-SU-2024:2939-1, SUSE-SU-2024:2394-1
SLE Live Patching 15 SP4 kernel-default 5.14.21-150400.24.128.1 SUSE-SU-2024:2929-1
SLE Live Patching 15 SP4 kernel-livepatch-SLE15-SP4_Update_29 1-150400.9.3.1 SUSE-SU-2024:2929-1
SLE HPC 15 SP4 kernel-64kb +5 5.14.21-150400.24.128.1 SUSE-SU-2024:2929-1
SLE HPC 15 SP4 kernel-default-base 5.14.21-150400.24.128.1.150400.24.62.1 SUSE-SU-2024:2929-1
SUSE Real Time Module 15 SP5 kernel-rt +3 5.14.21-150500.13.61.1 SUSE-SU-2024:2394-1
SUSE Manager Server 4.3 kernel-default-base 5.14.21-150400.24.128.1.150400.24.62.1 SUSE-SU-2024:2929-1
SUSE Manager Server 4.3 kernel-syms +3 5.14.21-150400.24.128.1 SUSE-SU-2024:2929-1
SUSE Manager Proxy 4.3 kernel-default-base 5.14.21-150400.24.128.1.150400.24.62.1 SUSE-SU-2024:2929-1
SUSE Manager Proxy 4.3 kernel-syms +2 5.14.21-150400.24.128.1 SUSE-SU-2024:2929-1
ReleasePackageFixed inAdvisory
openSUSE Leap 15.5 dtb-aarch64 +9 5.14.21-150500.55.73.1 SUSE-SU-2024:2939-1
openSUSE Leap 15.5 kernel-azure +2 5.14.21-150500.33.60.1 SUSE-SU-2024:2372-1
openSUSE Leap 15.5 kernel-default-base 5.14.21-150500.55.73.1.150500.6.33.8 SUSE-SU-2024:2939-1
openSUSE Leap 15.5 kernel-docs 5.14.21-150500.55.73.2 SUSE-SU-2024:2939-1
openSUSE Leap 15.5 kernel-rt +3 5.14.21-150500.13.61.1 SUSE-SU-2024:2394-1
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
openSUSE Leap Micro 5.5 kernel-default 5.14.21-150500.55.73.1 SUSE-SU-2024:2939-1
openSUSE Leap Micro 5.5 kernel-default-base 5.14.21-150500.55.73.1.150500.6.33.8 SUSE-SU-2024:2939-1

Advisories 6

References