KVM arm64 vgic-its: restored ITS device table entry with oversized num_eventid_bits is not rejected

Impact

On arm64 hosts, userspace restoring a virtual ITS Device Table Entry could encode more EventID bits than the virtual ITS supports. The live MAPD path rejected that, but vgic_its_restore_dte() stored the out-of-range value, which then reached vgic_its_restore_itt() and turned into an oversized scan_its_table() range. The CVSS vector marks a scope change with high impact on confidentiality and availability, consistent with a host-side memory read and crash driven from the restore path. The exposure is limited to arm64 KVM hosts - Grace-Hopper and other Arm GPU nodes - and the trigger is the VMM process performing a save/restore or migration, which is normally a trusted component; a GPU cloud that lets tenants supply or influence VM state blobs for live migration is the case that matters.

Who can reach it

Local - whatever userspace drives the KVM ITS save/restore ioctls on an arm64 host, typically QEMU or another VMM. The CVSS vector lists no privileges required at the local attack surface; in practice an attacker needs to control or influence the migration state fed to the VMM.

What to do

Update the host kernel to a stable release that rejects restored DTEs with num_eventid_bits above VITS_TYPER_IDBITS (commits linked in the record) and reboot the affected arm64 hosts - a drain and reboot per node, since the fix is in the KVM arm64 vgic code. Until patched, do not accept VM state blobs from untrusted sources for live migration or restore on arm64 GPU hosts. x86 hosts are not affected.

References

Related entries

• QEMU VGA device model (hw/display/vga.c) - banked access to video memory: 'Dark Portal' - the guest sets the VGA bankCVE-2016-3710 · QEMU VGA device model (hw/display/vga.c) - banked access to video memoryHigh
• Xen x86 PV pagetable update fast paths (arch/x86/mm.c): A 32-bit PV guest administrator gains full host privileges byCVE-2016-6258 · Xen x86 PV pagetable update fast paths (arch/x86/mm.c)High
• VMware ESXi (OpenSLP): OpenSLP heap overflow - the ESXiArgs ransomware entry point that mass-encrypted thousandsCVE-2021-21974 · VMware ESXi (OpenSLP)High
• Linux KVM x86 - stack out-of-bounds in ioapic_write_indirect(): A guest write to the virtual IOAPIC causes a stackCVE-2021-47390 · Linux KVM x86 - stack out-of-bounds in ioapic_write_indirect()High
• Xen (xenstored): Guest can crash xenstored, taking down control-plane services for all guests on the hostCVE-2022-42309 · Xen (xenstored)High
• Linux kernel drivers/vdpa/mlx5 (mlx5 vDPA net device): A guest with an assigned mlx5 vDPA net device sends anCVE-2022-48864 · Linux kernel drivers/vdpa/mlx5 (mlx5 vDPA net device)High