Linux kernel (arch/x86/kvm): A nested guest can put an out-of-range virtual-processor ID into an enlightened VMCS and

Impact

A nested guest can put an out-of-range virtual-processor ID into an enlightened VMCS and have KVM index a sparse-bank set with it unchecked, producing an out-of-bounds / use-after-free read in host kernel memory during a paravirtual TLB flush hypercall. A guest gets to read host memory it should never see, and can crash the node.

Who can reach it

Reachable from a guest that has Hyper-V enlightenments and nested virtualization available: the guest runs an L2 vCPU and copies an unbounded VP ID into the enlightened VMCS, then issues an HvFlush hypercall. KASAN caught it from an ordinary unprivileged process running a guest. Conditional on nested virt being exposed to tenants and Hyper-V enlightenments enabled.

What to do

Update to a kernel with the referenced stable commits. Interim: turn off nested virtualization for tenant VMs (kvm_intel nested=0 / kvm_amd nested=0) and disable Hyper-V enlightenments in the guest CPU model until nodes are patched.

References