CVE-2022-0516
📋 TL;DR
A local privilege escalation vulnerability in the KVM subsystem for s390 architecture in Linux kernel allows a local attacker with normal user privileges to gain unauthorized memory write access. This affects Linux kernel versions prior to 5.17-rc4. The flaw is in the kvm_s390_guest_sida_op function in arch/s390/kvm/kvm-s390.c.
💻 Affected Systems
- Linux kernel with KVM support for s390 architecture
📦 What is this software?
Enterprise Linux For Ibm Z Systems by Redhat
View all CVEs affecting Enterprise Linux For Ibm Z Systems →
Enterprise Linux For Ibm Z Systems Eus by Redhat
View all CVEs affecting Enterprise Linux For Ibm Z Systems Eus →
Enterprise Linux For Power Little Endian by Redhat
View all CVEs affecting Enterprise Linux For Power Little Endian →
Enterprise Linux For Power Little Endian Eus by Redhat
View all CVEs affecting Enterprise Linux For Power Little Endian Eus →
Enterprise Linux Server Update Services For Sap Solutions by Redhat
View all CVEs affecting Enterprise Linux Server Update Services For Sap Solutions →
Fedora by Fedoraproject
Fedora by Fedoraproject
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Local attacker gains kernel-level privileges, leading to full system compromise, data theft, or persistent backdoor installation.
Likely Case
Local user escalates privileges to root, enabling unauthorized access to sensitive data and system resources.
If Mitigated
Impact limited to isolated environments with strict user privilege separation and no local untrusted users.
🎯 Exploit Status
Requires local user access and knowledge of s390 architecture. No public exploit code has been disclosed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Linux kernel 5.17-rc4 and later
Vendor Advisory: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=09a93c1df3eafa43bcdfd7bf837c574911f12f55
Restart Required: Yes
Instructions:
1. Update Linux kernel to version 5.17-rc4 or later. 2. For distributions: Apply vendor patches (Red Hat, Debian, etc.). 3. Reboot system to load new kernel.
🔧 Temporary Workarounds
Disable KVM on s390
linuxDisable KVM virtualization support if not required on s390 systems
modprobe -r kvm
echo 'blacklist kvm' >> /etc/modprobe.d/blacklist.conf
Restrict user access
allLimit local user accounts and implement strict privilege separation
🧯 If You Can't Patch
- Implement strict access controls to limit local user accounts
- Monitor for privilege escalation attempts and unusual kernel activity
🔍 How to Verify
Check if Vulnerable:
Check kernel version: uname -r. If version is earlier than 5.17-rc4 and system uses s390 architecture with KVM enabled, it's vulnerable.Check Version:
uname -rVerify Fix Applied:
Verify kernel version is 5.17-rc4 or later: uname -r. Check that KVM module is loaded only if necessary.📡 Detection & Monitoring
Log Indicators:
- Failed privilege escalation attempts
- Unusual kernel module activity
- Suspicious access to /dev/kvm
Network Indicators:
- None (local exploit only)
SIEM Query:
source="kernel" AND (event="privilege_escalation" OR module="kvm")🔗 References
- https://bugzilla.redhat.com/show_bug.cgi?id=2050237
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=09a93c1df3eafa43bcdfd7bf837c574911f12f55
- https://security.netapp.com/advisory/ntap-20220331-0009/
- https://www.debian.org/security/2022/dsa-5092
- https://bugzilla.redhat.com/show_bug.cgi?id=2050237
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=09a93c1df3eafa43bcdfd7bf837c574911f12f55
- https://security.netapp.com/advisory/ntap-20220331-0009/
- https://www.debian.org/security/2022/dsa-5092
