In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
KVM: x86\/mmu: Bail from shadow walks if the root is invalid or a dummy<\/p>\n
When walking shadow page tables, immediately terminate the walk if the root
\nis a “dummy” root, i.e. a root whose top-level page table is backed by the
\nzero page, but otherwise doesn’t exist. If memslot creation races with a
\nstage-2 page fault (EPT violation or #NPF) from L2, then if the stars align,
\nKVM will attempt to walk shadow page tables using the zero page and hit a
\nNULL pointer deref.<\/p>\n
BUG: kernel NULL pointer dereference, address: 0000000000000021
\n #PF: supervisor read access in kernel mode
\n #PF: error_code(0x0000) – not-present page
\n PGD 0 P4D 0
\n Oops: Oops: 0000 [#1] SMP
\n CPU: 30 UID: 1000 PID: 941 Comm: qemu Not tainted 7.2.0-rc2-1b731e5ded48-next-vm #1741 PREEMPTLAZY
\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02\/06\/2015
\n RIP: 0010:__kvm_mmu_invalidate_addr+0xea\/0x210 [kvm]
\n Call Trace:<\/p>\n
kvm_mmu_invalidate_addr+0x92\/0xe0 [kvm]
\n __kvm_inject_emulated_page_fault+0x67\/0x80 [kvm]
\n ept_page_fault+0x160\/0x850 [kvm]
\n kvm_mmu_do_page_fault+0x102\/0x1f0 [kvm]
\n kvm_mmu_page_fault+0x8e\/0x6b0 [kvm]
\n vmx_handle_exit+0x163\/0x640 [kvm_intel]
\n kvm_arch_vcpu_ioctl_run+0x960\/0x2120 [kvm]
\n kvm_vcpu_ioctl+0x2c7\/0x970 [kvm]
\n __x64_sys_ioctl+0x90\/0xd0
\n do_syscall_64+0x67\/0x5f0
\n entry_SYSCALL_64_after_hwframe+0x4b\/0x53
\n RIP: 0033:0x7f606d0b53bb<\/p>\n
Opportunistically harden the shadow walks against fully invalid roots, but
\nWARN, as all callers are expected\/required to pre-check for a valid root.
\nDon’t WARN in the dummy root case as the whole point of using a dummy root
\nis to provide a root that’s valid enough to enter the guest, i.e. it should
\nJust Work for all flows except those that *need* to know about dummy roots.<\/p>\n
Alternatively, KVM could allocate a dedicated page and associated shadow
\npage structure for the dummy root, which is very tempting as it such an
\napproach should be more resilient against unexpected behavior. But that
\nwould be a much larger and thus riskier change than simply terminating
\nwalks of dummy roots.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
KVM: x86\/mmu: Bail from shadow walks if the root is invalid or a dummy<\/p>\n
When walking shadow page tables, immediately terminate the <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41189","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41189","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41189"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41189"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41189"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}