REDHAT-BUG-2213802: Race Condition
A KVM guest using SEV-ES or SEV-SNP with multiple vCPUs can trigger a double fetch race condition vulnerability and invoke the VMGEXIT handler recursively. If an attacker manages to call the handler multiple times, they can theoretically trigger a stack overflow and cause a denial-of-service or potentially guest-to-host escape in kernel configurations without stack guard pages (CONFIGVMAPSTACK).
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The issue affects Linux KVM hosts running SEV-ES or SEV-SNP guests with multiple virtual CPUs. The more serious guest-to-host escape outcome is described as theoretical and applies to kernel configurations without CONFIG_VMAP_STACK stack guard pages.
What does an attacker need to do to exploit it?
An attacker needs to control or operate within a vulnerable multi-vCPU SEV-ES or SEV-SNP guest and trigger the VMGEXIT handler repeatedly through a double-fetch race. Recursive handler invocation can exhaust the stack, causing denial of service and potentially more severe impact on hosts without stack guard pages.
Does CONFIG_VMAP_STACK affect the risk?
Yes. The described potential guest-to-host escape scenario is tied to kernel configurations that lack CONFIG_VMAP_STACK stack guard pages. Stack guard pages mitigate the stack-overflow aspect, although the provided information still identifies denial of service as a possible outcome.