REDHAT-BUG-1695044: High severity KVM KVM Hypervisor vulnerability
A flaw was found in the way KVM hypervisor handled x2APIC Machine Specific Rregister(MSR) access with nested(=1) virtualization enabled. In that, L1 guest could access L0's APIC register values via L2 guest, when 'virtualize x2APIC mode' is enabled.
A guest could use this flaw to potentially crash the host kernel resulting in DoS issue.
Upstream patches: ----------------- -> https://git.kernel.org/pub/scm/virt/kvm/kvm.git/commit/?id=acff78477b9b4f26ecdf65733a4ed77fe837e9dc -> https://git.kernel.org/pub/scm/virt/kvm/kvm.git/commit/?id=c73f4c998e1fd4249b9edfa39e23f4fda2b9b041
Reference: ---------- -> https://www.openwall.com/lists/oss-security/2019/04/08/1
Affected Software
Event History
Frequently Asked Questions
Which environments are exposed to this issue?
The issue applies to KVM environments using nested virtualization with x2APIC-mode virtualization enabled. It requires an L1 guest to run an L2 guest.
What access would an attacker need?
An attacker would need control of an L1 guest capable of interacting with an L2 guest in the affected nested-virtualization configuration. The described impact is a potential host-kernel crash, causing denial of service.
Is a default KVM deployment affected?
The available information only identifies systems with nested virtualization enabled and “virtualize x2APIC mode” enabled as affected. It does not establish whether those settings are enabled by default.