CVE-2024-46830 Information
Description
In the Linux kernel the following vulnerability has been resolved:
KVM: x86: Acquire kvm->srcu when handling KVM_SET_VCPU_EVENTS
Grab kvm->srcu when processing KVM_SET_VCPU_EVENTS as KVM will forcibly leave nested VMX/SVM if SMM mode is being toggled and leaving nested VMX reads guest memory.
Note kvm_vcpu_ioctl_x86_set_vcpu_events() can also be called from KVM_RUN via sync_regs() which already holds SRCU. I.e. trying to precisely use kvm_vcpu_srcu_read_lock() around the problematic SMM code would cause problems. Acquiring SRCU isn’t all that expensive so for simplicity grab it unconditionally for KVM_SET_VCPU_EVENTS.
============================= WARNING: suspicious RCU usage 6.10.0-rc7-332d2c1d713e-next-vm 552 Not tainted
include/linux/kvm_host.h:1027 suspicious rcu_dereference_check() usage!
other info that might help us debug this:
rcu_scheduler_active = 2 debug_locks = 1 1 lock held by repro/1071: 0: ffff88811e424430 (&vcpu->mutex)+.+.-3:3 at: kvm_vcpu_ioctl+0x7d/0x970 [kvm]
stack backtrace:
CPU: 15 PID: 1071 Comm: repro Not tainted 6.10.0-rc7-332d2c1d713e-next-vm 552
Hardware name: QEMU Standard PC (Q35 + ICH9 2009) BIOS 0.0.0 02/06/2015
Call Trace:
Reference
https://git.kernel.org/stable/c/fa297c33faefe51e10244e8a378837fca4963228 https://git.kernel.org/stable/c/939375737b5a0b1bf9b1e75129054e11bc9ca65e https://git.kernel.org/stable/c/ecdbe8ac86fb5538ccc623a41f88ec96c7168ab9 https://git.kernel.org/stable/c/4bcdd831d9d01e0fb64faea50732b59b2ee88da1
Share on: