KVM: x86: Play nice with protected guests in complete_hypercall_exit() (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.21 % · percentile 11 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Modified
Description
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Play nice with protected guests in complete_hypercall_exit() Use is_64_bit_hypercall() instead of is_64_bit_mode() to detect a 64-bit hypercall when completing said hypercall. For guests with protected state, e.g. SEV-ES and SEV-SNP, KVM must assume the hypercall was made in 64-bit mode as the vCPU state needed to detect 64-bit mode is unavailable. Hacking the sev_smoke_test selftest to generate a KVM_HC_MAP_GPA_RANGE hypercall via VMGEXIT trips the WARN: ------------[ cut here ]------------ WARNING: CPU: 273 PID: 326626 at arch/x86/kvm/x86.h:180 complete_hypercall_exit+0x44/0xe0 [kvm] Modules linked in: kvm_amd kvm ... [last unloaded: kvm] CPU: 273 UID: 0 PID: 326626 Comm: sev_smoke_test Not tainted 6.12.0-smp--392e932fa0f3-feat #470 Hardware name: Google Astoria/astoria, BIOS 0.20240617.0-0 06/17/2024 RIP: 0010:complete_hypercall_exit+0x44/0xe0 [kvm] Call Trace: <TASK> kvm_arch_vcpu_ioctl_run+0x2400/0x2720 [kvm] kvm_vcpu_ioctl+0x54f/0x630 [kvm] __se_sys_ioctl+0x6b/0xc0 do_syscall_64+0x83/0x160 entry_SYSCALL_64_after_hwframe+0x76/0x7e </TASK> ---[ end trace 0000000000000000 ]---
References
- https://git.kernel.org/stable/c/0840d360a8909c722fb62459f42836afe32ededb
- https://git.kernel.org/stable/c/7ed4db315094963de0678a8adfd43c46471b9349
- https://git.kernel.org/stable/c/3d2634ec0d1dbe8f4b511cf5261f327c6a76f4b6
- https://git.kernel.org/stable/c/22b5c2acd65dbe949032f619d4758a35a82fffc3
- https://git.kernel.org/stable/c/9b42d1e8e4fe9dc631162c04caa69b0d1860b0f0
- https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2024-52839
- GCVE · GCVE-0-2024-55881
CERT-FR advisories
- CERTFR-2025-AVI-1057 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0366 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0349 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0308 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0276 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0254 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0184 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0151 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0133 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0088 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.15.5 < 5.15.176cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.16.1 < 6.1.122cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.2 < 6.6.68cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.7 < 6.12.7cpe:2.3:o:linux:linux_kernel:5.16:-:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:5.16:rc2:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:5.16:rc3:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:5.16:rc4:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:5.16:rc5:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:5.16:rc6:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:5.16:rc7:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:5.16:rc8:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected 5969e2435cbd7f0ce8c28d717bfc39987ee8d8f1 < 0840d360a8909c722fb62459f42836afe32ededb ; affected b5aead0064f33ae5e693a364e3204fe1c0ac9af2 < 7ed4db315094963de0678a8adfd43c46471b9349 ; affected b5aead0064f33ae5e693a364e3204fe1c0ac9af2 < 3d2634ec0d1dbe8f4b511cf5261f327c6a76f4b6 ; affected b5aead0064f33ae5e693a364e3204fe1c0ac9af2 < 22b5c2acd65dbe949032f619d4758a35a82fffc3 ; affected b5aead0064f33ae5e693a364e3204fe1c0ac9af2 < 9b42d1e8e4fe9dc631162c04caa69b0d1860b0f0 ; affected 5.15.5 < 5.15.176 |
| Linux · Linux | affected 5.16 ; unaffected 0 < 5.16 ; unaffected 5.15.176 ≤ 5.15.* ; unaffected 6.1.122 ≤ 6.1.* ; unaffected 6.6.68 ≤ 6.6.* ; unaffected 6.12.7 ≤ 6.12.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |