CVE-2022-49219: vfio/pci: fix memory leak during D3hot to D0 transition
In the Linux kernel, the following vulnerability has been resolved:
vfio/pci: fix memory leak during D3hot to D0 transition
If 'vfio_pci_core_device::needs_pm_restore' is set (PCI device does
not have No_Soft_Reset bit set in its PMCSR config register), then
the current PCI state will be saved locally in
'vfio_pci_core_device::pm_save' during D0->D3hot transition and same
will be restored back during D3hot->D0 transition.
For saving the PCI state locally, pci_store_saved_state() is being
used and the pci_load_and_free_saved_state() will free the allocated
memory.
But for reset related IOCTLs, vfio driver calls PCI reset-related
API's which will internally change the PCI power state back to D0. So,
when the guest resumes, then it will get the current state as D0 and it
will skip the call to vfio_pci_set_power_state() for changing the
power state to D0 explicitly. In this case, the memory pointed by
'pm_save' will never be freed. In a malicious sequence, the state changing
to D3hot followed by VFIO_DEVICE_RESET/VFIO_DEVICE_PCI_HOT_RESET can be
run in a loop and it can cause an OOM situation.
This patch frees the earlier allocated memory first before overwriting
'pm_save' to prevent the mentioned memory leak.
Security readout for executives and security teams
Plain-English summary
CVE-2022-49219 is a Linux kernel VFIO PCI memory leak. On systems using PCI device passthrough, a malicious sequence of power-state changes and resets can repeatedly leak kernel memory, potentially causing an out-of-memory denial of service.
Executive priority
Prioritize patching virtualization hosts that provide PCI passthrough to guests or tenants. Business impact is service disruption from host memory exhaustion, not confirmed data theft or remote internet compromise from the provided evidence.
Technical view
The VFIO PCI path saves PCI state in pm_save during D0 to D3hot transitions. Reset-related IOCTL paths can return the device to D0 without the normal cleanup path, leaving pm_save allocated. The upstream fix frees previously allocated saved state before overwriting pm_save.
Likely exposure
Most relevant to Linux virtualization hosts using VFIO PCI passthrough, especially where guests or tenants can trigger VFIO device resets. Systems not using VFIO PCI passthrough are less likely to be exposed based on the provided sources.
Exploitation context
The CVE description states a malicious loop can cause an OOM condition. The source bundle does not show CISA KEV listing or active exploitation evidence. Exploitation appears to require local or guest-level access to VFIO-assigned PCI device reset functionality.
Researcher notes
The affected component is Linux kernel vfio/pci power-management handling. The fix addresses stale pm_save allocations when reset APIs change device power state outside the expected VFIO transition path. Version applicability should be confirmed against vendor kernels because the supplied affected-version data is incomplete and commit-based.
Mitigation direction
Apply vendor kernel updates containing the referenced VFIO PCI fix.
Check distribution advisories for exact fixed kernel versions.
Restrict VFIO PCI passthrough access to trusted workloads where possible.
Monitor affected virtualization hosts for memory exhaustion until patched.
Validation and detection
Inventory Linux hosts using VFIO PCI passthrough.
Identify running kernel versions and vendor patch status.
Compare kernels against the CVE record and distribution advisories.
Review whether untrusted guests can reset VFIO-assigned PCI devices.
Check logs for kernel OOM events on passthrough hosts.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2022-49219 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
0CVSS vectors
3Timeline events
1ADP providers
7Source links
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
CVE publishedCVE Program
The CVE record was published.
Feb 26, 2025, 01:55 UTC (UTC+00:00)
CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.