Linux kernel KVM/arm64: guest-controlled TLBI Range can overflow the hypervisor's range computation

Impact

TLB Invalidation by Range encodes very large ranges in few bits, based on a guest-chosen VA. KVM added that range to the base without capping it to the architectural limit dictated by the VA range bit, so a guest can overflow the computation. The consequence per the CVSS the kernel CNA assigned is mainly host availability with a scope change - a guest reaching outside its own boundary in what the hypervisor does on its behalf. On arm64 GPU hosts (Grace-Hopper and similar) running tenant VMs, that is a tenant able to disturb the host from inside a guest, on a node that cannot be drained cheaply. Exploitability beyond the availability impact is not established by the commit message.

Who can reach it

Local to the host, from inside a guest - any tenant holding a KVM guest on an arm64 host can issue the TLBI Range instructions that reach this path. No host credentials needed. x86 hosts are not affected.

What to do

Update to a stable kernel that caps the range to the architectural limit (IPA invalidation is further corrected downstream to ignore the upper range). This is a kernel-image fix, so arm64 virtualization hosts must be drained and rebooted; live-migrating guests off first avoids the tenant-visible outage. No mitigation short of not running untrusted guests on affected arm64 hosts.

References

Related entries

• Linux kernel RDS (Reliable Datagram Sockets) net/rds/page.c - rds_page_copy_user: Straight local-to-root. RDS - theCVE-2010-3904 · Linux kernel RDS (Reliable Datagram Sockets) net/rds/page.c - rds_page_copy_userHigh
• Linux kernel KVM device assignment IOMMU path virt/kvm/iommu.c - kvm_iommu_map_pages: When an IOMMU mapping failsCVE-2014-3601 · Linux kernel KVM device assignment IOMMU path virt/kvm/iommu.c - kvm_iommu_map_pagesHigh
• ABRT: symlink attack on predictable core-dump paths gives local users root on RHEL hostsCVE-2015-5287 · ABRT abrt-hook-ccpp (core dump helper on RHEL/CentOS)High
• Linux kernel (mm, COW): Dirty COW: privilege escalation via MAP_PRIVATE COW breakageCVE-2016-5195 · Linux kernel (mm, COW)High
• Linux kernel VFIO drivers/vfio/pci/vfio_pci.c - VFIO_DEVICE_SET_IRQS ioctl: A state-machine confusion inCVE-2016-9083 · Linux kernel VFIO drivers/vfio/pci/vfio_pci.c - VFIO_DEVICE_SET_IRQS ioctlHigh
• Linux kernel VFIO drivers/vfio/pci/vfio_pci_intrs.c - MSI/MSI-X allocation: Sibling of CVE-2016-9083 in the sameCVE-2016-9084 · Linux kernel VFIO drivers/vfio/pci/vfio_pci_intrs.c - MSI/MSI-X allocationHigh