KVM arm64: hypervisor stack pages left in the host stage-2 mapping

Impact

On arm64 hosts running protected KVM, fix_host_ownership() walked only the linear-map alias of each memblock region. The per-CPU hyp stacks are mapped in the private VA range so they get a guard page and have no linear-map alias, so their pages were never taken out of the host stage-2 and the host kernel retained access to hypervisor stack memory. That undercuts the boundary pKVM exists to provide: a compromised host kernel can read and write the hypervisor's own stacks rather than being confined by stage-2. For operators this is the arm64 accelerator hosts - Grace-class and other Arm server nodes - where confidential or isolated guest VMs are sold on the assumption the host cannot reach hypervisor state. Exploitation requires privilege on the host already, so this is a defense-in-depth failure rather than a tenant-to-host break.

Who can reach it

Local with high privilege: code already running in the host kernel context on an arm64 node booted with protected KVM. Not reachable from a guest or from an unprivileged tenant process, and not applicable to x86 hosts.

What to do

Update to a stable kernel containing the fix, which walks each stack's private VA range with the same walker - commits 22df195bff84, 3a8c562892b9, e5dd2a91a7ae - then drain and reboot each affected arm64 host. There is no runtime mitigation: stage-2 ownership is established at hyp init, so a reboot onto the fixed kernel is the only fix. x86 fleets need no action.

References

Related entries

• libcurl: use-after-free when a TLS 1.3 session ticket arrives on a reused connectionCVE-2021-22901 · curl / libcurl (OpenSSL TLS 1.3 session ticket handling)High
• Linux kernel (net/tls): When a NIC with active kTLS offload goes down, the offload teardown freed the TLS context whileCVE-2021-47131 · Linux kernel (net/tls)High
• VMware ESXi / Workstation / Fusion (storage controller out-of-bounds read/write): A malicious actor inside a VMCVE-2024-22273 · VMware ESXi / Workstation / Fusion (storage controller out-of-bounds read/write)High
• Linux kernel (net/xfrm): The error path of xfrm_input leaves the secpath entry pointing at poisoned memory, and theCVE-2024-43878 · Linux kernel (net/xfrm)High
• Linux kernel NVMe target authentication (nvmet-auth DH group setup): CtrlCVE-2024-50215 · Linux kernel NVMe target authentication (nvmet-auth DH group setup)High
• OpenSSH (sshd): regreSSHion: signal-handler race in sshd giving unauthenticated remote root on glibc LinuxCVE-2024-6387 · OpenSSH (sshd)High