LiveActive security incident?Get immediate response
CVE Record

CVE-2022-49883: KVM: x86: smm: number of GPRs in the SMRAM image depends on the image format

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: smm: number of GPRs in the SMRAM image depends on the image format On 64 bit host, if the guest doesn't have X86_FEATURE_LM, KVM will access 16 gprs to 32-bit smram image, causing out-ouf-bound ram access. On 32 bit host, the rsm_load_state_64/enter_smm_save_state_64 is compiled out, thus access overflow can't happen.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This is a Linux KVM virtualization bug in System Management Mode state handling. On 64-bit hosts, certain 32-bit guests can trigger KVM to read or write beyond the expected guest state image. The provided sources do not include a CVSS score, active exploitation evidence, or operational impact details.

Executive priority

Treat this as a virtualization-platform patch validation item, not a confirmed emergency. Prioritize shared or multi-tenant KVM infrastructure because the bug sits at a guest-host virtualization boundary, but the supplied evidence does not prove active exploitation or business impact.

Technical view

KVM x86 SMM handling used the wrong number of general-purpose registers for a 32-bit SMRAM image when the guest lacks X86_FEATURE_LM. On 64-bit hosts this can cause out-of-bounds RAM access. The source notes 32-bit hosts are not affected because the relevant 64-bit routines are compiled out.

Likely exposure

Exposure is most relevant to Linux systems running KVM on 64-bit hosts with guests that do not advertise long mode. The bundle lists Linux kernel 6.0-era versions and kernel git references, but exact downstream distribution exposure requires vendor mapping.

Exploitation context

The source bundle does not identify public exploitation, and KEV status is false. The description implies guest-triggered behavior inside KVM, but it does not provide exploitability, privilege impact, crash behavior, or guest-to-host security boundary conclusions.

Researcher notes

Focus analysis on KVM x86 SMM save/restore paths and SMRAM image format selection. The key condition is 64-bit host plus guest without X86_FEATURE_LM. Avoid assuming impact beyond out-of-bounds RAM access unless confirmed by upstream or distribution analysis.

Mitigation direction

  • Review Linux vendor advisories for CVE-2022-49883 coverage.
  • Upgrade affected kernels to versions containing the referenced stable fixes.
  • Prioritize 64-bit KVM hosts running non-long-mode guests.
  • Track downstream distribution backports, not only upstream version numbers.
  • Apply standard VM isolation and tenant separation controls pending patch confirmation.

Validation and detection

  • Inventory Linux KVM hosts and running kernel versions.
  • Identify guests lacking X86_FEATURE_LM where feasible.
  • Check whether referenced stable commits are present or backported.
  • Confirm distribution security advisories mark the CVE fixed.
  • Document any unpatched 64-bit KVM hosts as exposure exceptions.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-49883 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
3Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxb443183a25ab61840a12de92f8822849e017b9c8, b443183a25ab61840a12de92f8822849e017b9c8unaffected
LinuxLinux6.0, 0, 6.0.8, 6.1affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.