docs: add details on CVE-2022-1789
@@ -499,6 +499,42 @@ stable kernel releases. Please follow [kernel.org](https://www.kernel.org/) and
once the fix is available in your stable release please update the host kernel.
If you are not using a vanilla kernel, please check with Linux distro provider.
+#### [CVE-2022-1789](https://nvd.nist.gov/vuln/detail/CVE-2022-1789)
+
+##### Description
+
+With shadow paging enabled, the `INVPCID` instruction results in a call to
+`kvm_mmu_invpcid_gva`. If `INVPCID` is executed with `CR0.PG=0`, the invlpg
+callback is not set and the result is a NULL pointer dereference.
+
+##### Impact
+
+A malicious attacker running on the guest can cause a DoS (Denial of Service).
+
+##### Vulnerable systems
+
+The vulnerability affects systems that have shadow paging enabled and use
+the following host kernel versions:
+
+- 5.10.x prior to 5.10.119
+- 5.15.x prior to 5.15.44
+- 5.17.x prior to 5.17.12
+
+Systems that use extended page table are not susceptible to this attack.
+To verify that extended page table is enabled, run the following command:
+
+```bash
+cat /sys/module/kvm_intel/parameters/ept
+```
+
+If the output is `Y` then KVM uses extended page table, otherwise if `N`
+then KVM uses shadow pages.
+
+##### Mitigation
+
+The vulnerability is fixed by [this commit][4]. The fix was integrated in
+5.10.119, 5.15.44 and 5.17.12 kernel releases.
+
#### [ARM only] Physical counter directly passed through to the guest
On ARM, the physical counter (i.e `CNTPCT`) it is returning the
@@ -510,3 +546,4 @@ to trap and control this in the hypervisor.
[1]: https://elixir.free-electrons.com/linux/v4.14.203/source/virt/kvm/arm/hyp/timer-sr.c#L63
[2]: https://lists.cs.columbia.edu/pipermail/kvmarm/2017-January/023323.html
[3]: https://elixir.bootlin.com/linux/v4.17/source/include/uapi/linux/prctl.h#L212
+[4]: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=9f46c187e2e680ecd9de7983e4d081c3391acc76
