REDHAT-BUG-2467065: High severity Linux Linux kernel vulnerability
In the Linux kernel, the following vulnerability has been resolved:
KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation
Commit cc3ed80ae69f ("KVM: nSVM: always use vmcb01 to for vmsave/vmload of guest state") made KVM always use vmcb01 for the fields controlled by VMSAVE/VMLOAD, but it missed updating the VMLOAD/VMSAVE emulation code to always use vmcb01.
As a result, if VMSAVE/VMLOAD is executed by an L2 guest and is not intercepted by L1, KVM will mistakenly use vmcb02. Always use vmcb01 instead of the current VMCB.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using KVM with nested AMD virtualization (nSVM) are exposed when an L2 guest can execute VMLOAD or VMSAVE and those instructions are not intercepted by the L1 guest.
What conditions are required for exploitation?
The issue requires a nested-virtualization setup with an L2 guest. VMLOAD or VMSAVE must be executed by that L2 guest without interception by L1, causing KVM to use vmcb02 rather than vmcb01 during emulation.
What can be done if an update cannot be applied immediately?
Avoid the affected execution path by not running untrusted L2 guests in nested AMD virtualization environments, or configure the L1 environment to intercept VMLOAD and VMSAVE if that control is available.