Paolo Bonzini

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 6.6.65 **Description** The issue concerns the KVM implementation in the Linux kernel, specifically with Intel PT virtualization in guest/host mode. There are multiple bugs in the implementation, some of which can be fatal to the guest and others that put the stability and health of the host at risk. The most significant problem is that KVM fails to ensure tracing is disabled before VM-Enter, which is necessary for hardware to load the guest's RTIT CTL. Additionally, KVM does not validate the guest CPUID configuration provided by userspace and uses this configuration to decide what MSRs to save/load at VM-Enter and VM-Exit. This can lead to KVM trying to passthrough, save, and load non-existent MSRs, resulting in various warnings and potential deadlocks. **Recommendations** To resolve the issue, update the Linux kernel to version 6.6.65 or later. As a temporary workaround, consider disabling the Intel PT virtualization in guest/host mode until a patch is available. Restrict access to the KVM module to minimize the risk of exploitation. Avoid configuring guest CPUID to enumerate more address ranges than are supported in hardware until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 5.17.0-rc3+ **Description** A vulnerability in the Linux kernel has been identified, specifically in the KVM (Kernel-based Virtual Machine) component for x86 architecture. The issue arises from the handling of triple faults in L2 (nested virtualization) and how userspace can induce KVM REQ TRIPLE FAULT without going through KVM RUN, which guarantees the handling of the triple fault by kvm check nested state(). This can be triggered if userspace injects a machine check while L2 is active and CR4.MCE=0. The vulnerability does not specify the number of potentially affected devices or details about real-world incidents. **Recommendations** For Linux kernel versions prior to 5.17.0-rc3+, update to a version that includes the fix for the KVM x86 triple fault handling issue. As a temporary workaround, consider restricting the use of nested virtualization until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to a potential NULL dereference on nested migration in the KVM component of the Linux kernel, specifically in the nSVM functionality. This is caused by the `nested svm load cr3` function being called too early, before the NPT is enabled, which prevents KVM from accessing guest memory and initializing the `walk mmu`. The exploitation of this issue may allow an attacker to cause a denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The issue occurs when processing the VMCB (virtual machine control block) provided by the L1 guest to spawn/handle a nested guest (L2). Due to improper validation of the `virt ext` field, this issue could allow a malicious L1 to disable both VMLOAD/VMSAVE intercepts and VLS (Virtual VMLOAD/VMSAVE) for the L2 guest. As a result, the L2 guest would be allowed to read/write physical pages of the host, resulting in a crash of the entire system, leak of sensitive data, or potential guest-to-host escape. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 5.12.11 **Description** The issue is related to the incorrect computation of access permissions for a shadow page in the Linux kernel, leading to a missing guest protection page fault. This could potentially allow an attacker to cause a denial of service. The estimated number of potentially affected devices and details about real-world incidents are not provided. **Recommendations** For versions prior to 5.12.11, update to version 5.12.11 or later to resolve the issue. As a temporary workaround, consider restricting access to critical resources to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue concerns the Linux kernel, where various PV features (Async PF, PV EOI, steal time) work through memory shared with the hypervisor. When restoring from hibernation, these features must be properly torn down to prevent the hypervisor from writing to stale locations after jumping to the previously hibernated kernel. The job is already done for secondary CPUs by kvm cpu down prepare(), and syscore ops are registered to do the same for the boot CPU. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.8 Description: An issue in the Linux kernel allows a set memory region test infinite loop for certain nested page faults. This can be exploited to cause a denial of service. Recommendations: For Linux kernel versions prior to 5.8, update to version 5.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable `set memory region test` function in `arch/x86/kvm/svm/svm.c` to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 4.8.7 **Description** The issue allows local users to cause a denial of service, resulting in a host OS crash. This is achieved through a certain use of a ModR/M byte in an undefined instruction when KVM is enabled. **Recommendations** For versions prior to 4.8.7, update to version 4.8.7 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** libunwind version 1.1 **Description** The issue is related to an off-by-one error in the `dwarf to unw regnum` function, which could potentially cause an error when reading untrusted binaries or dwarf debug info data. It is unlikely that any exploitable attack vector exists in current builds or supported usage. **Recommendations** For libunwind version 1.1, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 3.9 **Description** The issue is related to the `scsi ioctl` function in the Linux kernel, which does not properly consider the SCSI device class during authorization of SCSI commands. This allows local users to bypass intended access restrictions via an SG IO ioctl call that leverages overlapping opcodes. The vulnerability can be exploited to elevate privileges. **Recommendations** For Linux kernel versions prior to 3.9, update to a version 3.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the SG IO ioctl call to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** QEMU versions prior to 0.15.2 **Description** A buffer overflow issue exists in the SCSI subsystem of QEMU, which could allow local guest users with permission to access the CD-ROM to cause a denial of service (guest crash) via a crafted SAI READ CAPACITY SCSI command. This issue is only considered a vulnerability when specific permissions or ACLs have been manually modified by root. **Recommendations** For QEMU versions prior to 0.15.2, update to version 0.15.2 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Xen versions 4.0.1 and earlier **Description** The issue arises from the `fixup page fault` function in `arch/x86/traps.c` when paravirtualization is enabled on 64-bit platforms. It fails to verify that kernel mode is used to call the `handle gdt ldt mapping fault` function. This allows guest OS users to cause a denial of service (host OS BUG ON) via a crafted memory access. **Recommendations** For Xen versions 4.0.1 and earlier, consider updating to a newer version that includes the fix for this issue. As a temporary workaround, consider restricting access to paravirtualization features to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Linux kernel version 2.6.18 in Red Hat Enterprise Linux (RHEL) 5 **Description** The issue allows guest OS users to cause a denial of service, specifically a 32-bit guest OS crash, by exploiting the MMIO instruction decoder in the Xen hypervisor. This is achieved through vectors that trigger an unspecified instruction emulation. **Recommendations** For Linux kernel version 2.6.18 in Red Hat Enterprise Linux (RHEL) 5, consider applying a patch or update that addresses the MMIO instruction decoder issue in the Xen hypervisor to prevent guest OS users from causing a denial of service. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** KVM version 83 **Description** The issue is related to the x86 emulator in KVM, specifically when a guest is configured for Symmetric Multiprocessing (SMP). It does not properly restrict writing of segment selectors to segment registers. This could allow guest OS users to cause a denial of service (guest OS crash) or gain privileges on the guest OS. The potential exploitation involves leveraging access to an IO port or MMIO region and replacing an instruction in between emulator entry and instruction fetch. **Recommendations** For KVM version 83, consider restricting access to IO ports and MMIO regions to minimize the risk of exploitation. As a temporary workaround, limiting the use of Symmetric Multiprocessing (SMP) in guest configurations may help reduce the vulnerability until a proper fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.