KVM: arm64 SRCU Lock Missing in Page Table Walks

Executive Summary

This vulnerability exists in the Linux kernel's KVM (Kernel-based Virtual Machine) for the arm64 architecture. Specifically, certain functions involved in page table walks during fault injection and address translation emulation do not properly acquire the SRCU lock (kvm->srcu) as expected. The functions walk_s1() and kvm_walk_nested_s2() require holding this lock to guard against changes in memory slots, but __kvm_at_s12() and __kvm_find_s1_desc_level() call these walkers without acquiring the lock. This can lead to unsafe conditions during page table walks.

The fix involves acquiring the SRCU lock (kvm->srcu) before performing the page table walk in these instances to ensure proper synchronization and prevent potential issues.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability has been resolved by acquiring the kvm->srcu lock prior to page table walks in fault injection and AT emulation within the Linux kernel's KVM arm64 code.

To mitigate this vulnerability, you should update your Linux kernel to a version that includes this fix.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability involves improper locking in the Linux kernel's KVM subsystem for arm64 architectures, specifically related to page table walks during fault injection and address translation emulation. The issue arises because certain functions call page table walkers without holding the required SRCU lock, which is intended to guard against memory slot changes. This could potentially lead to race conditions or inconsistent memory state during virtualization operations.

The impact could include instability or incorrect behavior in virtualized environments running on affected Linux kernels, possibly leading to crashes or security issues related to memory management in KVM.

Useful 0 Not Useful 0