| From bippy-1.2.0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@kernel.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2025-37936: perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU's value. |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU's value. |
| |
| When generating the MSR_IA32_PEBS_ENABLE value that will be loaded on |
| VM-Entry to a KVM guest, mask the value with the vCPU's desired PEBS_ENABLE |
| value. Consulting only the host kernel's host vs. guest masks results in |
| running the guest with PEBS enabled even when the guest doesn't want to use |
| PEBS. Because KVM uses perf events to proxy the guest virtual PMU, simply |
| looking at exclude_host can't differentiate between events created by host |
| userspace, and events created by KVM on behalf of the guest. |
| |
| Running the guest with PEBS unexpectedly enabled typically manifests as |
| crashes due to a near-infinite stream of #PFs. E.g. if the guest hasn't |
| written MSR_IA32_DS_AREA, the CPU will hit page faults on address '0' when |
| trying to record PEBS events. |
| |
| The issue is most easily reproduced by running `perf kvm top` from before |
| commit 7b100989b4f6 ("perf evlist: Remove __evlist__add_default") (after |
| which, `perf kvm top` effectively stopped using PEBS). The userspace side |
| of perf creates a guest-only PEBS event, which intel_guest_get_msrs() |
| misconstrues a guest-*owned* PEBS event. |
| |
| Arguably, this is a userspace bug, as enabling PEBS on guest-only events |
| simply cannot work, and userspace can kill VMs in many other ways (there |
| is no danger to the host). However, even if this is considered to be bad |
| userspace behavior, there's zero downside to perf/KVM restricting PEBS to |
| guest-owned events. |
| |
| Note, commit 854250329c02 ("KVM: x86/pmu: Disable guest PEBS temporarily |
| in two rare situations") fixed the case where host userspace is profiling |
| KVM *and* userspace, but missed the case where userspace is profiling only |
| KVM. |
| |
| The Linux kernel CVE team has assigned CVE-2025-37936 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 6.0 with commit c59a1f106f5cd4843c097069ff1bb2ad72103a67 and fixed in 6.1.138 with commit 160153cf9e4aa875ad086cc094ce34aac8e13d63 |
| Issue introduced in 6.0 with commit c59a1f106f5cd4843c097069ff1bb2ad72103a67 and fixed in 6.6.90 with commit 34b6fa11431aef71045ae5a00d90a7d630597eda |
| Issue introduced in 6.0 with commit c59a1f106f5cd4843c097069ff1bb2ad72103a67 and fixed in 6.12.28 with commit 44ee0afc9d1e7a7c1932698de01362ed80cfc4b5 |
| Issue introduced in 6.0 with commit c59a1f106f5cd4843c097069ff1bb2ad72103a67 and fixed in 6.14.6 with commit 86aa62895fc2fb7ab09d7ca40fae8ad09841f66b |
| Issue introduced in 6.0 with commit c59a1f106f5cd4843c097069ff1bb2ad72103a67 and fixed in 6.15 with commit 58f6217e5d0132a9f14e401e62796916aa055c1b |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2025-37936 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| arch/x86/events/intel/core.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/160153cf9e4aa875ad086cc094ce34aac8e13d63 |
| https://git.kernel.org/stable/c/34b6fa11431aef71045ae5a00d90a7d630597eda |
| https://git.kernel.org/stable/c/44ee0afc9d1e7a7c1932698de01362ed80cfc4b5 |
| https://git.kernel.org/stable/c/86aa62895fc2fb7ab09d7ca40fae8ad09841f66b |
| https://git.kernel.org/stable/c/58f6217e5d0132a9f14e401e62796916aa055c1b |
