Описание
In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Serialize accesses to the owner and mirror list with separate lock Interaction between KVM_CAP_VM_MOVE_ENC_CONTEXT_FROM and KVM_CAP_VM_COPY_ENC_CONTEXT_FROM can cause two separate issues:
- in sev_migrate_from(), when the destination KVM is a mirror, the mirror entry is moved from the source's list to the owner's mirror_vms list, without holding the owner's lock unlike other writers of the owner's mirror list (sev_vm_copy_enc_context_from(), sev_vm_destroy()). A concurrent COPY or destroy can race with sev_migrate_from() and corrupt the list.
- In sev_vm_destroy(), the owner is still active and could receive
concurrently a KVM_CAP_VM_MOVE_ENC_CONTEXT_FROM that causes
sev->enc_context_owner to change. In this case the incorrect VM
receives kvm_put_kvm().
The second issue needs particular care because the owner could disappear
altogether (even though the race window is impossibly small) between
reading it and locking it. There is thus no way to perform the checks
under the owner lock without putting struct kvm under SLAB_TYPESAFE_BY_RCU
(which would allow kvm_get_kvm_safe() under RCU critical section).
It is much simpler to just use a global lock, since the critical
sections are so small and the new lock is always a leaf lock.
A flaw was found in the Kernel-based Virtual Machine (KVM) Secure Virtual Machine (SVM) module within the Linux kernel. This vulnerability involves a race condition during the management of encrypted virtual machine contexts, specifically when handling owner and mirror lists. A privileged user or malicious guest virtual machine could exploit this timing issue during concurrent operations, such as virtual machine migration or destruction. This could lead to corruption of internal data structures or incorrect handling of virtual machine resources, potentially resulting in system instability or a denial of service.
Отчет
A race condition flaw with Moderate security impact was found in the KVM SVM (AMD Secure Encrypted Virtualization) support of the Linux kernel used in Red Hat Enterprise Linux and Red Hat In-Vehicle OS. Interaction between the KVM_CAP_VM_MOVE_ENC_CONTEXT_FROM and KVM_CAP_VM_COPY_ENC_CONTEXT_FROM operations, together with concurrent virtual machine destruction, accesses the SEV owner and mirror virtual machine lists without consistent locking: sev_migrate_from() can move a mirror entry from a source list to the owner's mirror_vms list without holding the owner's lock, and sev_vm_destroy() can apply kvm_put_kvm() to the wrong virtual machine if the owner concurrently receives a MOVE that changes sev->enc_context_owner. A local user with privileges to issue these KVM operations on an AMD SEV capable host, or a malicious guest virtual machine, could exploit this timing race to corrupt KVM internal data structures or mishandle virtual machine resources, potentially causing a kernel panic and denial of service of the host. The vulnerable code, which allows SEV intra-host migration of VMs with mirrors and was introduced upstream in Linux 5.18, was backported into Red Hat Enterprise Linux starting with the 8.7 release; therefore Red Hat Enterprise Linux 6 and 7, and the 8.4 and 8.6 update streams (kernel and kernel-rt), are not affected because the vulnerable code is not present. For the affected Red Hat Enterprise Linux 8, 9, and 10 streams and the Red Hat In-Vehicle OS streams, the fix is currently deferred: correctly serializing these paths requires reworking the locking around SEV encrypted-context migration, and because Red Hat assesses the practical impact as availability only, the fix will be delivered in a future update rather than as an urgent fix. The residual risk is that a local privileged user able to trigger the small race window on an AMD SEV KVM host could crash the host kernel. Red Hat rates this flaw Moderate (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because the realistic impact is denial of service with unchanged scope. The CVE.org record assigns a higher score (CVSS 8.8) by assuming high confidentiality and integrity impact and a scope change, which Red Hat's assessment does not support.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
5.5 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Serialize accesses to the owner and mirror list with separate lock Interaction between KVM_CAP_VM_MOVE_ENC_CONTEXT_FROM and KVM_CAP_VM_COPY_ENC_CONTEXT_FROM can cause two separate issues: - in sev_migrate_from(), when the destination KVM is a mirror, the mirror entry is moved from the source's list to the owner's mirror_vms list, without holding the owner's lock unlike other writers of the owner's mirror list (sev_vm_copy_enc_context_from(), sev_vm_destroy()). A concurrent COPY or destroy can race with sev_migrate_from() and corrupt the list. - In sev_vm_destroy(), the *owner* is still active and could receive concurrently a KVM_CAP_VM_MOVE_ENC_CONTEXT_FROM that causes sev->enc_context_owner to change. In this case the incorrect VM receives kvm_put_kvm(). The second issue needs particular care because the owner could disappear altogether (even though the race window is impossibly small) between reading it...
In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Serialize accesses to the owner and mirror list with separate lock Interaction between KVM_CAP_VM_MOVE_ENC_CONTEXT_FROM and KVM_CAP_VM_COPY_ENC_CONTEXT_FROM can cause two separate issues: - in sev_migrate_from(), when the destination KVM is a mirror, the mirror entry is moved from the source's list to the owner's mirror_vms list, without holding the owner's lock unlike other writers of the owner's mirror list (sev_vm_copy_enc_context_from(), sev_vm_destroy()). A concurrent COPY or destroy can race with sev_migrate_from() and corrupt the list. - In sev_vm_destroy(), the *owner* is still active and could receive concurrently a KVM_CAP_VM_MOVE_ENC_CONTEXT_FROM that causes sev->enc_context_owner to change. In this case the incorrect VM receives kvm_put_kvm(). The second issue needs particular care because the owner could disappear altogether (even though the race window is impossibly small)
KVM: SVM: Serialize accesses to the owner and mirror list with separate lock
In the Linux kernel, the following vulnerability has been resolved: K ...
In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Serialize accesses to the owner and mirror list with separate lock Interaction between KVM_CAP_VM_MOVE_ENC_CONTEXT_FROM and KVM_CAP_VM_COPY_ENC_CONTEXT_FROM can cause two separate issues: - in sev_migrate_from(), when the destination KVM is a mirror, the mirror entry is moved from the source's list to the owner's mirror_vms list, without holding the owner's lock unlike other writers of the owner's mirror list (sev_vm_copy_enc_context_from(), sev_vm_destroy()). A concurrent COPY or destroy can race with sev_migrate_from() and corrupt the list. - In sev_vm_destroy(), the *owner* is still active and could receive concurrently a KVM_CAP_VM_MOVE_ENC_CONTEXT_FROM that causes sev->enc_context_owner to change. In this case the incorrect VM receives kvm_put_kvm(). The second issue needs particular care because the owner could disappear altogether (even though the race window is impossibly smal...
EPSS
5.5 Medium
CVSS3