Vulnerabilities > CVE-2022-1789 - NULL Pointer Dereference vulnerability in multiple products

047910
CVSS 6.9 - MEDIUM
Attack vector
LOCAL
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE

Summary

With shadow paging enabled, the INVPCID instruction results in a call to kvm_mmu_invpcid_gva. If INVPCID is executed with CR0.PG=0, the invlpg callback is not set and the result is a NULL pointer dereference.

Vulnerable Configurations

Part Description Count
OS
Linux
3623
OS
Fedoraproject
3
OS
Redhat
1
OS
Debian
1

Common Weakness Enumeration (CWE)