CVE-2023-53663
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-10-07

Last updated on: 2026-02-26

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Check instead of asserting on nested TSC scaling support Check for nested TSC scaling support on nested SVM VMRUN instead of asserting that TSC scaling is exposed to L1 if L1's MSR_AMD64_TSC_RATIO has diverged from KVM's default. Userspace can trigger the WARN at will by writing the MSR and then updating guest CPUID to hide the feature (modifying guest CPUID is allowed anytime before KVM_RUN). E.g. hacking KVM's state_test selftest to do vcpu_set_msr(vcpu, MSR_AMD64_TSC_RATIO, 0); vcpu_clear_cpuid_feature(vcpu, X86_FEATURE_TSCRATEMSR); after restoring state in a new VM+vCPU yields an endless supply of: ------------[ cut here ]------------ WARNING: CPU: 164 PID: 62565 at arch/x86/kvm/svm/nested.c:699 nested_vmcb02_prepare_control+0x3d6/0x3f0 [kvm_amd] Call Trace: <TASK> enter_svm_guest_mode+0x114/0x560 [kvm_amd] nested_svm_vmrun+0x260/0x330 [kvm_amd] vmrun_interception+0x29/0x30 [kvm_amd] svm_invoke_exit_handler+0x35/0x100 [kvm_amd] svm_handle_exit+0xe7/0x180 [kvm_amd] kvm_arch_vcpu_ioctl_run+0x1eab/0x2570 [kvm] kvm_vcpu_ioctl+0x4c9/0x5b0 [kvm] __se_sys_ioctl+0x7a/0xc0 __x64_sys_ioctl+0x21/0x30 do_syscall_64+0x41/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x45ca1b Note, the nested #VMEXIT path has the same flaw, but needs a different fix and will be handled separately.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-10-07
Last Modified
2026-02-26
Generated
2026-05-07
AI Q&A
2025-10-07
EPSS Evaluated
2026-05-05
NVD
Affected Vendors & Products
Showing 3 associated CPEs
Vendor Product Version / Range
linux kvm_amd *
linux kvm *
linux linux_kernel From 5.15.160 (inc) to 5.16 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability in the Linux kernel's KVM (Kernel-based Virtual Machine) relates to nested SVM (Secure Virtual Machine) TSC (Time Stamp Counter) scaling support. Instead of properly checking for nested TSC scaling support during nested VMRUN operations, the kernel asserts that TSC scaling is exposed to the first-level guest (L1) if L1's MSR_AMD64_TSC_RATIO register has diverged from KVM's default. This assertion can be triggered by userspace by writing to the MSR and then modifying the guest CPUID to hide the feature, causing an endless warning loop and potential instability in nested virtualization environments.


How can this vulnerability impact me? :

The vulnerability can cause instability or crashes in nested virtualization environments using KVM on Linux. Specifically, userspace can trigger repeated warnings and potentially disrupt the operation of virtual machines by manipulating the MSR_AMD64_TSC_RATIO and guest CPUID features. This could lead to denial of service or degraded performance in systems relying on nested virtualization.


How can this vulnerability be detected on my network or system? Can you suggest some commands?

This vulnerability can be detected by monitoring the system logs for repeated WARNINGS related to nested TSC scaling support in KVM's nested SVM. Specifically, look for messages similar to: 'WARNING: CPU: ... nested_vmcb02_prepare_control+0x3d6/0x3f0 [kvm_amd]'. You can use commands like 'dmesg | grep -i kvm' or 'journalctl -k | grep -i kvm' to find such warnings. Additionally, monitoring for repeated WARN messages related to nested SVM in kernel logs can indicate the presence of this issue.


What immediate steps should I take to mitigate this vulnerability?

Immediate mitigation involves updating the Linux kernel to a version where this vulnerability is fixed. The fix involves checking for nested TSC scaling support on nested SVM VMRUN instead of asserting, preventing the WARN from being triggered. Until the kernel is updated, avoid manipulating the MSR_AMD64_TSC_RATIO and guest CPUID features in ways that trigger this condition. If possible, disable nested virtualization features that use nested SVM to reduce exposure.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart