Xen Timer Initialization Flaw in Linux Kernel Affects KVM by Linux Foundation

CVE-2022-50227

What is CVE-2022-50227?

The Linux kernel vulnerability affects the KVM module by failing to properly initialize the Xen timer. The function kvm_xen_init_timer() is invoked multiple times without checks, leading to potential crashes when the vcpu's xen timer is already set. This oversight can result in application instability due to ODEBUG assertions during timer initialization. To mitigate this issue, the implementation should include checks to confirm whether a Xen timer already exists before initializing a new one, enhancing the overall stability and functionality of KVM virtualization.

References