Sean Christopherson

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 6.6.65 **Description** The issue concerns the KVM implementation in the Linux kernel, specifically with Intel PT virtualization in guest/host mode. There are multiple bugs in the implementation, some of which can be fatal to the guest and others that put the stability and health of the host at risk. The most significant problem is that KVM fails to ensure tracing is disabled before VM-Enter, which is necessary for hardware to load the guest's RTIT CTL. Additionally, KVM does not validate the guest CPUID configuration provided by userspace and uses this configuration to decide what MSRs to save/load at VM-Enter and VM-Exit. This can lead to KVM trying to passthrough, save, and load non-existent MSRs, resulting in various warnings and potential deadlocks. **Recommendations** To resolve the issue, update the Linux kernel to version 6.6.65 or later. As a temporary workaround, consider disabling the Intel PT virtualization in guest/host mode until a patch is available. Restrict access to the KVM module to minimize the risk of exploitation. Avoid configuring guest CPUID to enumerate more address ranges than are supported in hardware until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to the `mmio read()` function in the Linux kernel, which makes a TDVMCALL to retrieve MMIO data for an address from the VMM. The function unintentionally exposes the value of an initialized variable (`val`) on the stack to the VMM. This variable is only needed as an output value and did not need to be passed to the VMM in the first place. The problem can be exploited to cause a denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The vulnerability is related to the KVM component in the Linux kernel, specifically with the virtualization of adaptive PEBS. The issue arises because KVM's implementation is architecturally broken, and exposing adaptive PEBS can leak host LBRs to the guest, potentially allowing the guest to read host kernel addresses. There are five identified bugs: 1. KVM doesn't account for the upper 32 bits of IA32 FIXED CTR CTRL when reprogramming fixed counters. 2. KVM always sets precise ip to a non-zero value for PEBS events, causing perf to generate an adaptive record even if the guest requested a basic record. 3. The perf function intel pmu disable fixed() doesn't clear the upper bits, leaving ICL FIXED 0 ADAPTIVE set. 4. Adaptive PEBS might bypass event filters set by the host, recording information that could be disallowed by userspace via KVM SET PMU EVENT FILTER. 5. KVM doesn't ensure LBR MSRs hold guest values when entering a vCPU with adaptive PEBS, allowing the guest to read host LBRs by enabling "LBR Entries" records. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 5.17.0-rc3+ **Description** A vulnerability in the Linux kernel has been identified, specifically in the KVM (Kernel-based Virtual Machine) component for x86 architecture. The issue arises from the handling of triple faults in L2 (nested virtualization) and how userspace can induce KVM REQ TRIPLE FAULT without going through KVM RUN, which guarantees the handling of the triple fault by kvm check nested state(). This can be triggered if userspace injects a machine check while L2 is active and CR4.MCE=0. The vulnerability does not specify the number of potentially affected devices or details about real-world incidents. **Recommendations** For Linux kernel versions prior to 5.17.0-rc3+, update to a version that includes the fix for the KVM x86 triple fault handling issue. As a temporary workaround, consider restricting the use of nested virtualization until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A vulnerability in the Linux kernel has been identified, specifically in the KVM (Kernel-based Virtual Machine) component. The issue arises when unmapping a GFN (Guest Frame Number) range in the TDP MMU, where KVM fails to zap all roots, including invalid ones. This can lead to use-after-free and other issues if the mmu notifier runs to completion while an invalid root zapper yields. The bug can be reproduced by causing a collision between set nx huge pages() and kvm mmu notifier release(). **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 5.15.0-rc2+ **Description** The vulnerability is related to a NULL pointer dereference in the `set hv tscchange cb()` function when setting Hyper-V's TSC change callback. If Hyper-V setup fails, the kernel will still report that it's running under Hyper-V, but will have silently disabled nearly all functionality. This can lead to a denial of service. The issue is caused by a kernel NULL pointer dereference, which occurs when the `hv vp index` array is not checked for validity before being dereferenced. **Recommendations** To resolve the issue, update the Linux kernel to a version that includes the fix for the NULL pointer dereference in `set hv tscchange cb()`. As a temporary workaround, consider disabling the `set hv tscchange cb()` function until a patch is available. However, this may have unintended consequences and should be done with caution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to KVM: VMX, where preemption is disabled when probing user return MSRs via RDSMR/WRMSR. If the MSR holds a different value per logical CPU, the WRMSR could corrupt the host's value if KVM is preempted between the RDMSR and WRMSR, and then rescheduled on a different CPU. The helper will be used in common x86, and SVM will use it in a future commit. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to the use of memory after it has been freed during the registration of input/output devices in the Kernel-based Virtual Machine (KVM) subsystem of the Linux kernel. This could lead to a denial of service. The problem arises when allocating a new instance of an I/O bus fails during device unregistration. To fix this, devices should be destroyed after all readers have seen the new null bus, preventing use-after-free errors. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.