In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
KVM: nVMX: Service local TLB flushes on failed nested VM-Enter<\/p>\n
KVM services local TLB flushes on “full” nested VM-Exits (through
\n__nested_vmx_vmexit()), but not if a nested VM-Enter fails (e.g. due to
\nfailed VMCS checks in nested_vmx_enter_non_root_mode()).<\/p>\n
However, it is possible that KVM had queued TLB flushes that need to be
\nperformed, even if the nested VM-Enter was not successful. For example,
\nif VPID is disabled for L2 (via nested_vmx_transition_tlb_flush(), or if
\nvia the MSR load lists, as the SDM says:<\/p>\n
If any MSR is being loaded in such a way that would architecturally
\n require a TLB flush, the TLBs are updated so that, after VM entry, the
\n logical processor will not use any translations that were cached before
\n the transition.<\/p>\n
The SDM is unclear about when the TLB flush should occur, and whether or
\nnot a failed VM entry would flush the TLB, so it is safer to always
\ndo the TLB flush in this case.<\/p>\n
More concretely, KVM also updates the last VPID L1 used for L2 in
\nnested_vmx_transition_tlb_flush() (i.e. last_vpid), even if the VM entry
\nultimately fails. With the current code, KVM could miss a TLB flush if
\nL1 changes L2’s VPID, then does a failed VM entry followed by a
\nsuccessful one, as the failed VM entry would update last_vpid but not
\nactually flush the TLB. Servicing local TLB flushes on failed VM entries
\nmakes sure that the TLB is always flushed when last_vpid is updated.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
KVM: nVMX: Service local TLB flushes on failed nested VM-Enter<\/p>\n
KVM services local TLB flushes on “full” nested VM-Exits (through
\n_<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-24617","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/24617","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=24617"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=24617"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=24617"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}