CVE-2022-1263 is a NULL pointer dereference vulnerability in KVM affecting various Linux distributions, including Red Hat Enterprise Linux. An unprivileged local attacker can trigger a kernel oops via specific ioctl calls when dirty ring support is enabled, leading to a denial of service. Rated Medium (CVSS 5.5), this flaw requires local access and has a high impact on availability. There is currently no public exploit code, active exploitation, or significant community discussion surrounding this vulnerability.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 5.18CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
5.18CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:5.18:rc1:*:*:*:*:*:* | ||
5.18CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:5.18:rc2:*:*:*:*:*:* | ||
8.0CPE matchmatch criteria | cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* | ||
9.0CPE matchmatch criteria | cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
CVE-2022-1263
Sep 13, 2022A NULL pointer dereference issue was found in KVM when releasing a vCPU with dirty ring support enabled. This flaw allows an unprivileged local attacker on the host to issue specific ioctl calls causing a kernel oops condition that results in a denial of service.
Aug 9, 2022kernel: KVM: NULL pointer dereference in kvm_dirty_ring_push in virt/kvm/dirty_ring.c
Apr 7, 2022