REDHAT-BUG-1278496: High severity KVM KVM vulnerability
It was found that a malicious HVM guest administrator can cause DoS, specifically prevent use of physical CPU for significant, perhaps indefinite period. When a benign exception occurs while delivering another benign exception, it is architecturally specified that these would be delivered sequentially. There are, however, cases where this results in an infinite loop inside the CPU, which (in the virtualized case) can be broken only by intercepting delivery of the respective exception.
When a guest sets up a hardware breakpoint covering a data structure involved in delivering #DB (Debug Exception), upon completion of the delivery of the first exception another #DB will need to be delivered. The effects slightly differ depending on further guest characteristics:
Guests running in 32-bit mode would be expected to sooner or later encounter another fault due to the stack pointer decreasing during each iteration of the loop. The most likely case would be #PF (Page Fault) due to running into unmapped virtual space. However, an infinite loop cannot be excluded (e.g. when the guest is running with paging disabled).
Guests running in long mode, but not using the IST (Interrupt Stack Table) feature for the IDT entry corresponding to #DB would behave similarly to guests running in 32-bit mode, just that the larger virtual address space allows for a much longer loop. The loop can't, however, be infinite, as eventually the stack pointer would move into non-canonical address space, causing #SS (Stack Fault) instead.
Guests running in long mode and using the IST for the IDT entry corresponding to #DB would enter an infinite loop, as the stack pointer wouldn't change between #DB instances.
If a host watchdog (Xen or dom0) is in use, this can lead to a watchdog timeout and consequently a reboot of the host. If another, innocent, guest, is configured with a watchdog, this issue can lead to a reboot of such a guest.
A privileged user inside guest could use this flaw to crash the host kernel resulting in DoS.
For KVM virtualisation, it only affects the AMD processor support, as for Intel it already intercepts the #DB exception.
Upstream KVM patch: ------------------- -> http://permalink.gmane.org/gmane.linux.kernel/2082332
References: ----------- -> http://www.openwall.com/lists/oss-security/2015/11/10/1
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this denial-of-service issue?
Hosts running KVM that allow an administrator of an HVM guest to configure the affected guest debugging behavior are exposed. The impact is denial of service against a physical CPU, potentially for a significant or indefinite period.
What must an attacker do to trigger the problem?
A malicious HVM guest administrator must set a hardware breakpoint covering a data structure involved in delivery of a debug exception (#DB). When another #DB is required after the first exception is delivered, the CPU can enter a loop that requires interception of the exception delivery to break.
Does guest execution mode affect the outcome?
Yes. In 32-bit guests, repeated looping may eventually cause another fault as the stack pointer decreases, commonly a page fault, although an infinite loop remains possible when paging is disabled. The provided information also indicates that long-mode guests have different effects depending on further guest characteristics.