In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
KVM: nVMX: Move vTPR vs. TPR Threshold consistency check into “normal” checks<\/p>\n
Move the off-by-default consistency check for vmcs12.tpr_threshold vs.
\nthe virtual APIC vTPR into the “normal” controls checks, as waiting until
\nKVM has loaded some amount of state is unnecessary and actively dangerous.
\nSpecifically, failure to unwind vmcs01.GUEST_CR3 to KVM’s value when EPT
\nis disabled results in KVM running L1 with an L1-controlled CR3, not with
\nKVM’s CR3!<\/p>\n
Alternatively, KVM could simply reset the MMU to force a reload of
\nvmcs01.GUEST_CR3, but the _only_ reason the check was shoved into a “late”
\nflow was to wait until the vmcs12 pages were retrieved. Rather than build
\nup more crusty code, simply access vTPR using a regular guest memory access
\n(performance isn’t a concern). To circumvent the restrictions that led to
\nKVM deferring nested_get_vmcs12_pages(), (a) use a VM-scoped API to read
\nguest memory so that it always hits non-SMM memslots (for RSM), and (b)
\nskip the check (since its off-by-default anyways) when the vCPU doesn’t
\nwant to run, i.e. when userspace is restoring\/stuffing state.<\/p>\n
If reading guest memory fails, simply skip the consistency check, as KVM’s
\nde facto ABI is that VMX instruction accesses to non-existent memory get
\nPCI Bus Error semantics, where reads return 0xFFs. And if vTPR=0xFF, then
\nthe vTPR is guaranteed to be greater than or equal to TPR_THRESHOLD.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
KVM: nVMX: Move vTPR vs. TPR Threshold consistency check into “normal” checks<\/p>\n
Move the off-by-default consistency check for vmcs12<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-6905","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/6905","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6905"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6905"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6905"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}