Paolo Bonzini

The issue concerns the KVM implementation in the Linux kernel, specifically with Intel PT virtualization in guest/host mode. There are multiple bugs in the implementation, some of which can be fatal to the guest and others that put the stability and health of the host at risk. The most significant problem is that KVM fails to ensure tracing is disabled before VM-Enter, which is necessary for hardware to load the guest's RTIT CTL. Additionally, KVM does not validate the guest CPUID configuration provided by userspace and uses this configuration to decide what MSRs to save/load at VM-Enter and VM-Exit. This can lead to KVM trying to passthrough, save, and load non-existent MSRs, resulting in various warnings and potential deadlocks.

تم تحديد ثغرة أمنية في نواة لينكس، وتحديدًا في مكون KVM (الآلة الافتراضية المستندة إلى النواة) الخاص ببيئة x86. ينشأ المشكل من معالجة الأخطاء الثلاثية في L2 (الافتراضية المتداخلة) وكيف يمكن لمساحة المستخدم (userspace) أن تثير KVM REQ TRIPLE FAULT دون المرور عبر KVM RUN، وهو ما يضمن معالجة الخطأ الثلاثي بواسطة kvm check nested state(). ويمكن أن يحدث ذلك إذا قام مساحة المستخدم بحقن فحص الجهاز (machine check) أثناء نشاط L2 وكون CR4.MCE=0. ولا تحدد الثغرة الأمنية عدد الأجهزة التي قد تتأثر بها أو تفاصيل حول الحوادث التي وقعت في الواقع.

The issue is related to a potential NULL dereference on nested migration in the KVM component of the Linux kernel, specifically in the nSVM functionality. This is caused by the `nested svm load cr3` function being called too early, before the NPT is enabled, which prevents KVM from accessing guest memory and initializing the `walk mmu`. The exploitation of this issue may allow an attacker to cause a denial of service.

A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The issue occurs when processing the VMCB (virtual machine control block) provided by the L1 guest to spawn/handle a nested guest (L2). Due to improper validation of the `virt ext` field, this issue could allow a malicious L1 to disable both VMLOAD/VMSAVE intercepts and VLS (Virtual VMLOAD/VMSAVE) for the L2 guest. As a result, the L2 guest would be allowed to read/write physical pages of the host, resulting in a crash of the entire system, leak of sensitive data, or potential guest-to-host escape.

The issue is related to the incorrect computation of access permissions for a shadow page in the Linux kernel, leading to a missing guest protection page fault. This could potentially allow an attacker to cause a denial of service. The estimated number of potentially affected devices and details about real-world incidents are not provided.

The issue concerns the Linux kernel, where various PV features (Async PF, PV EOI, steal time) work through memory shared with the hypervisor. When restoring from hibernation, these features must be properly torn down to prevent the hypervisor from writing to stale locations after jumping to the previously hibernated kernel. The job is already done for secondary CPUs by kvm cpu down prepare(), and syscore ops are registered to do the same for the boot CPU.

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.8 Description: An issue in the Linux kernel allows a set memory region test infinite loop for certain nested page faults. This can be exploited to cause a denial of service. Recommendations: For Linux kernel versions prior to 5.8, update to version 5.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable `set memory region test` function in `arch/x86/kvm/svm/svm.c` to minimize the risk of exploitation.

The issue allows local users to cause a denial of service, resulting in a host OS crash. This is achieved through a certain use of a ModR/M byte in an undefined instruction when KVM is enabled.

The issue is related to an off-by-one error in the `dwarf to unw regnum` function, which could potentially cause an error when reading untrusted binaries or dwarf debug info data. It is unlikely that any exploitable attack vector exists in current builds or supported usage.

The issue is related to the `scsi ioctl` function in the Linux kernel, which does not properly consider the SCSI device class during authorization of SCSI commands. This allows local users to bypass intended access restrictions via an SG IO ioctl call that leverages overlapping opcodes. The vulnerability can be exploited to elevate privileges.

A buffer overflow issue exists in the SCSI subsystem of QEMU, which could allow local guest users with permission to access the CD-ROM to cause a denial of service (guest crash) via a crafted SAI READ CAPACITY SCSI command. This issue is only considered a vulnerability when specific permissions or ACLs have been manually modified by root.

The issue arises from the `fixup page fault` function in `arch/x86/traps.c` when paravirtualization is enabled on 64-bit platforms. It fails to verify that kernel mode is used to call the `handle gdt ldt mapping fault` function. This allows guest OS users to cause a denial of service (host OS BUG ON) via a crafted memory access.

The issue allows guest OS users to cause a denial of service, specifically a 32-bit guest OS crash, by exploiting the MMIO instruction decoder in the Xen hypervisor. This is achieved through vectors that trigger an unspecified instruction emulation.

The issue is related to the x86 emulator in KVM, specifically when a guest is configured for Symmetric Multiprocessing (SMP). It does not properly restrict writing of segment selectors to segment registers. This could allow guest OS users to cause a denial of service (guest OS crash) or gain privileges on the guest OS. The potential exploitation involves leveraging access to an IO port or MMIO region and replacing an instruction in between emulator entry and instruction fetch.