Sean Christopherson

The issue concerns the KVM implementation in the Linux kernel, specifically with Intel PT virtualization in guest/host mode. There are multiple bugs in the implementation, some of which can be fatal to the guest and others that put the stability and health of the host at risk. The most significant problem is that KVM fails to ensure tracing is disabled before VM-Enter, which is necessary for hardware to load the guest's RTIT CTL. Additionally, KVM does not validate the guest CPUID configuration provided by userspace and uses this configuration to decide what MSRs to save/load at VM-Enter and VM-Exit. This can lead to KVM trying to passthrough, save, and load non-existent MSRs, resulting in various warnings and potential deadlocks.

The issue is related to the `mmio read()` function in the Linux kernel, which makes a TDVMCALL to retrieve MMIO data for an address from the VMM. The function unintentionally exposes the value of an initialized variable (`val`) on the stack to the VMM. This variable is only needed as an output value and did not need to be passed to the VMM in the first place. The problem can be exploited to cause a denial of service.

The vulnerability is related to the KVM component in the Linux kernel, specifically with the virtualization of adaptive PEBS. The issue arises because KVM's implementation is architecturally broken, and exposing adaptive PEBS can leak host LBRs to the guest, potentially allowing the guest to read host kernel addresses. There are five identified bugs: 1. KVM doesn't account for the upper 32 bits of IA32 FIXED CTR CTRL when reprogramming fixed counters. 2. KVM always sets precise ip to a non-zero value for PEBS events, causing perf to generate an adaptive record even if the guest requested a basic record. 3. The perf function intel pmu disable fixed() doesn't clear the upper bits, leaving ICL FIXED 0 ADAPTIVE set. 4. Adaptive PEBS might bypass event filters set by the host, recording information that could be disallowed by userspace via KVM SET PMU EVENT FILTER. 5. KVM doesn't ensure LBR MSRs hold guest values when entering a vCPU with adaptive PEBS, allowing the guest to read host LBRs by enabling "LBR Entries" records.

تم تحديد ثغرة أمنية في نواة لينكس، وتحديدًا في مكون KVM (الآلة الافتراضية المستندة إلى النواة) الخاص ببيئة x86. ينشأ المشكل من معالجة الأخطاء الثلاثية في L2 (الافتراضية المتداخلة) وكيف يمكن لمساحة المستخدم (userspace) أن تثير KVM REQ TRIPLE FAULT دون المرور عبر KVM RUN، وهو ما يضمن معالجة الخطأ الثلاثي بواسطة kvm check nested state(). ويمكن أن يحدث ذلك إذا قام مساحة المستخدم بحقن فحص الجهاز (machine check) أثناء نشاط L2 وكون CR4.MCE=0. ولا تحدد الثغرة الأمنية عدد الأجهزة التي قد تتأثر بها أو تفاصيل حول الحوادث التي وقعت في الواقع.

تم تحديد ثغرة أمنية في نواة لينكس، وتحديدًا في مكون KVM (الآلة الافتراضية المستندة إلى النواة). تظهر المشكلة عند إلغاء تعيين نطاق GFN (Guest Frame Number) في TDP MMU، حيث يفشل KVM في إبطال صلاحية جميع الجذور، بما في ذلك الجذور غير الصالحة. وقد يؤدي ذلك إلى حدوث استغلال بعد التحرير (use-after-free) ومشاكل أخرى إذا أنهى mmu notifier تنفيذه بينما يقوم مُبطِل الجذر غير الصالح بالتنازل عن التنفيذ. يمكن إعادة إنتاج هذا الخطأ عن طريق إحداث تضارب بين الدالتين set nx huge pages() و kvm mmu notifier release().

The vulnerability is related to a NULL pointer dereference in the `set hv tscchange cb()` function when setting Hyper-V's TSC change callback. If Hyper-V setup fails, the kernel will still report that it's running under Hyper-V, but will have silently disabled nearly all functionality. This can lead to a denial of service. The issue is caused by a kernel NULL pointer dereference, which occurs when the `hv vp index` array is not checked for validity before being dereferenced.

The issue is related to KVM: VMX, where preemption is disabled when probing user return MSRs via RDSMR/WRMSR. If the MSR holds a different value per logical CPU, the WRMSR could corrupt the host's value if KVM is preempted between the RDMSR and WRMSR, and then rescheduled on a different CPU. The helper will be used in common x86, and SVM will use it in a future commit.

The issue is related to the use of memory after it has been freed during the registration of input/output devices in the Kernel-based Virtual Machine (KVM) subsystem of the Linux kernel. This could lead to a denial of service. The problem arises when allocating a new instance of an I/O bus fails during device unregistration. To fix this, devices should be destroyed after all readers have seen the new null bus, preventing use-after-free errors.