Linux KVM x86 - hypercall completion for protected guests: KVM used the wrong helper to decide whether a hypercall

CVSS 5.5CVE-2024-55881Kernel, userspace & hypervisorcurated

Impact

KVM used the wrong helper to decide whether a hypercall was 64-bit when completing it, which misbehaves for guests with protected state such as SEV-ES and SEV-SNP where the host cannot see guest registers. The result is host-side state confusion driven by a confidential guest - a crash or incorrect emulation on the hypervisor path that every other guest on the node shares.

Who can reach it

From inside a protected (SEV-ES/SNP) guest issuing hypercalls.

What to do

Fixed in the Linux kernel - KVM/x86 SEV code or the ccp/PSP driver. Take the distro kernel update (RHEL/Rocky, Ubuntu, SLES) and **reboot the host**; SEV/SNP hypervisor paths cannot be live-patched in any meaningful way, and SNP platform init/shutdown is not safe to cycle under running guests. Drain confidential-VM tenants, reboot, then re-admit. No firmware, VBIOS or AGESA step needed, which makes this one of the cheaper classes of SEV fix to roll out.

References

https://nvd.nist.gov/vuln/detail/CVE-2024-55881

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.