Executive Summary

This vulnerability exists in the Linux kernel's KVM nested virtualization feature (nSVM). When the system tries to restore the host's CR3 register during a nested VM exit (#VMEXIT), if loading L1's CR3 fails, the function nested_svm_vmexit() returns an error code that most callers ignore. This causes the nested virtual machine (L1) to continue running with a corrupted state.

Because the corrupted state cannot be recovered sanely, the hardware behavior is to cause a shutdown. The fix involves injecting a triple fault instead of returning early from nested_svm_vmexit(), and continuing to clean up the virtual CPU state (such as clearing pending exceptions) to handle the failure more gracefully.

Useful 0 Not Useful 0

Impact Analysis

If this vulnerability is triggered, it can cause the host system to shut down unexpectedly due to a triple fault triggered by corrupted CPU state during nested virtualization operations.

This can lead to system instability, potential data loss, and disruption of services running on the affected Linux kernel with nested virtualization enabled.

Useful 0 Not Useful 0

Mitigation Strategies

This vulnerability has been resolved in the Linux kernel by changing the handling of nested #VMEXIT when loading L1's CR3 fails. The fix involves injecting a triple fault instead of continuing with corrupted state and cleaning up the vCPU state to handle the failure gracefully.

To mitigate this vulnerability immediately, you should update your Linux kernel to a version that includes this fix.

Useful 0 Not Useful 0