cve/published/2024/CVE-2024-55881.mbox

From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: <linux-cve-announce@vger.kernel.org>
Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
Subject: CVE-2024-55881: KVM: x86: Play nice with protected guests in complete_hypercall_exit()

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86: Play nice with protected guests in complete_hypercall_exit()

Use is_64_bit_hypercall() instead of is_64_bit_mode() to detect a 64-bit
hypercall when completing said hypercall.  For guests with protected state,
e.g. SEV-ES and SEV-SNP, KVM must assume the hypercall was made in 64-bit
mode as the vCPU state needed to detect 64-bit mode is unavailable.

Hacking the sev_smoke_test selftest to generate a KVM_HC_MAP_GPA_RANGE
hypercall via VMGEXIT trips the WARN:

  ------------[ cut here ]------------
  WARNING: CPU: 273 PID: 326626 at arch/x86/kvm/x86.h:180 complete_hypercall_exit+0x44/0xe0 [kvm]
  Modules linked in: kvm_amd kvm ... [last unloaded: kvm]
  CPU: 273 UID: 0 PID: 326626 Comm: sev_smoke_test Not tainted 6.12.0-smp--392e932fa0f3-feat #470
  Hardware name: Google Astoria/astoria, BIOS 0.20240617.0-0 06/17/2024
  RIP: 0010:complete_hypercall_exit+0x44/0xe0 [kvm]
  Call Trace:
   <TASK>
   kvm_arch_vcpu_ioctl_run+0x2400/0x2720 [kvm]
   kvm_vcpu_ioctl+0x54f/0x630 [kvm]
   __se_sys_ioctl+0x6b/0xc0
   do_syscall_64+0x83/0x160
   entry_SYSCALL_64_after_hwframe+0x76/0x7e
   </TASK>
  ---[ end trace 0000000000000000 ]---

The Linux kernel CVE team has assigned CVE-2024-55881 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.15.5 with commit 5969e2435cbd7f0ce8c28d717bfc39987ee8d8f1 and fixed in 5.15.176 with commit 0840d360a8909c722fb62459f42836afe32ededb
	Issue introduced in 5.16 with commit b5aead0064f33ae5e693a364e3204fe1c0ac9af2 and fixed in 6.1.122 with commit 7ed4db315094963de0678a8adfd43c46471b9349
	Issue introduced in 5.16 with commit b5aead0064f33ae5e693a364e3204fe1c0ac9af2 and fixed in 6.6.68 with commit 3d2634ec0d1dbe8f4b511cf5261f327c6a76f4b6
	Issue introduced in 5.16 with commit b5aead0064f33ae5e693a364e3204fe1c0ac9af2 and fixed in 6.12.7 with commit 22b5c2acd65dbe949032f619d4758a35a82fffc3
	Issue introduced in 5.16 with commit b5aead0064f33ae5e693a364e3204fe1c0ac9af2 and fixed in 6.13 with commit 9b42d1e8e4fe9dc631162c04caa69b0d1860b0f0

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-55881
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	arch/x86/kvm/x86.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/0840d360a8909c722fb62459f42836afe32ededb
	https://git.kernel.org/stable/c/7ed4db315094963de0678a8adfd43c46471b9349
	https://git.kernel.org/stable/c/3d2634ec0d1dbe8f4b511cf5261f327c6a76f4b6
	https://git.kernel.org/stable/c/22b5c2acd65dbe949032f619d4758a35a82fffc3
	https://git.kernel.org/stable/c/9b42d1e8e4fe9dc631162c04caa69b0d1860b0f0