REDHAT-BUG-560654: High severity KVM KVM vulnerability
Gleb Napatov found a bug in KVM that can be used to bypass proper IOPL/CPL checking. KVM relies on CPU to check IOPL/CPL before instruction execution, so emulator doesn't do IOPL/CPL checking. Malicious guest process running in SMP guest can bypass CPU IOPL/CPL checking if it has access to IO port or MMIO region. To do so it should run legitimate instruction that does IO and will cause vcpu to enter emulator in one thread and replace this instruction to malicious one from another thread. If instruction is replaced after KVM entered emulator, but before instruction is fetched emulator will be tricked to execute privileged instruction without permission checking.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems running KVM with SMP guests are exposed when an untrusted or malicious process can run inside a guest and has access to an I/O port or MMIO region. The issue is in the guest-to-hypervisor execution path rather than requiring direct host access.
What does an attacker need to exploit it?
The attacker needs to execute code in an SMP guest, trigger a legitimate I/O instruction that causes a vCPU to enter the emulator, and use another guest thread to replace that instruction before the emulator fetches it. They also need access to an I/O port or MMIO region.
What is the impact of successful exploitation?
A malicious guest process can cause KVM's emulator to execute a privileged instruction without the intended IOPL/CPL permission checks. This bypasses the normal privilege checking relied on by KVM for instruction execution.