CVE-2022-48763

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86: Forcibly leave nested virt when SMM state is toggled

Forcibly leave nested virtualization operation if userspace toggles SMM

state via KVM_SET_VCPU_EVENTS or KVM_SYNC_X86_EVENTS. If userspace

forces the vCPU out of SMM while it's post-VMXON and then injects an SMI,

vmx_enter_smm() will overwrite vmx->nested.smm.vmxon and end up with both

vmxon=false and smm.vmxon=false, but all other nVMX state allocated.

Don't attempt to gracefully handle the transition as (a) most transitions

are nonsencial, e.g. forcing SMM while L2 is running, (b) there isn't

sufficient information to handle all transitions, e.g. SVM wants access

to the SMRAM save state, and (c) KVM_SET_VCPU_EVENTS must precede

KVM_SET_NESTED_STATE during state restore as the latter disallows putting

the vCPU into L2 if SMM is active, and disallows tagging the vCPU as

being post-VMXON in SMM if SMM is not active.

Abuse of KVM_SET_VCPU_EVENTS manifest

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References