CVE-2020-2732: Infoleak
A flaw was discovered in the way that the KVM hypervisor handled instruction emulation for an L2 guest when nested virtualisation is enabled. Under some circumstances, an L2 guest may trick the L0 guest into accessing sensitive L1 resources that should be inaccessible to the L2 guest.
Other sources
A flaw was found in the way KVM hypervisor handled instruction emulation for the L2 guest when nested(=1) virtualization is enabled. In the instruction emulation, the L2 guest could trick the L0 hypervisor into accessing sensitive bits of the L1 hypervisor. An L2 guest could use this flaw to potentially access information of the L1 hypervisor.
Under certain circumstances, an L2 guest may trick the L0 hypervisor into accessing sensitive L1 resources that are supposed to be inaccessible to the L2 guest according to L1 hypervisor configuration.
Only Intel processors are affected. It requires netsted virtualization to be enabled, ie. kvm-intel.nested=1.
Upstream patch(es): ------------------- -> https://www.spinics.net/lists/kvm/msg208259.html -> https://git.kernel.org/linus/07721feee46b4b248402133228235318199b05ec -> https://git.kernel.org/linus/35a571346a94fb93b5b3b6a599675ef3384bc75c -> https://git.kernel.org/linus/e71237d3ff1abf9f3388337cfebf53b96df2020d
Reference: ---------- -> https://www.openwall.com/lists/oss-security/2020/02/25/3
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:3.10.0-1160.rt56.1131.el7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-1160.el7 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-193.1.2.rt13.53.el8_2 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-193.1.2.el8_2 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.262-1Fixed in 6.1.176-1Fixed in 6.1.180-1Fixed in 6.12.94-1Fixed in 6.12.101-1Fixed in 7.1.8-1Fixed in 7.1.8-2
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2020-2732?
CVE-2020-2732 has a critical severity rating as it allows an L2 guest to potentially access restricted L1 resources.
How do I fix CVE-2020-2732?
To fix CVE-2020-2732, update the affected kernel packages to the provided remedial versions for your operating system.
Which versions of Red Hat Enterprise Linux are affected by CVE-2020-2732?
CVE-2020-2732 affects Red Hat Enterprise Linux 7.0 and 8.0 versions.
What types of systems are vulnerable due to CVE-2020-2732?
Systems utilizing KVM hypervisor with nested virtualization enabled are vulnerable due to CVE-2020-2732.
What can an attacker achieve through CVE-2020-2732?
An attacker can compromise the L0 guest by accessing sensitive information from the L1 resources through the L2 guest.