QID 355563

a denial of service (dos) issue was found in the linux kernel’s smb2_ioctl_query_info function in the fs/cifs/smb2ops.c common internet file system (cifs) due to an incorrect return from the memdup_user function.
This flaw allows a local, privileged (cap_sys_admin) attacker to crash the system. (
( CVE-2022-0168) when the kvm updates the guests page table entry, it will first use get_user_pages_fast() to pin the page, and when it fails (e.g. the vma->flags has vm_io or vm_pfnmap), it will get corresponding vma where the page lies in through find_vma_intersection(), calculate the physical address, and map the page to the kernel virtual address through memremap(), and finally, write the update. the problem is that when we get the vma through find_vma_intersection(), only vm_pfnmap is checked, not both vm_io and vm_pfnmap.
In the reproducer below, after the kvm_set_user_memory_region is completed, we replace the guests memory mapping with the kernel-user shared region of io_uring and then perform the kvm_translate operation, which finally triggers the page table entry update.
Now, memremap() will return page_offset_base (direct mapping of all physical memory) + vaddr (the linear address of kvm_translate) + vm_pgoff (the offset when io_uring performs mmap(2)), and use the return value as the base address for cmpxchg (write 0x21 in this case).
Since both vaddr and vm_pgoff are controllable by the user-mode process, writing may exceed the previously mapped guest memory space and trigger exceptions such as uaf.
The vulnerability shares similarities with( CVE-2021-22543. (
This flaw allows a local user to crash the system. (
( CVE-2023-28410)

Successful exploitation of this vulnerability could lead to a securitybreach or could affect integrity, availability, and confidentiality.