CVE-2023-53756

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

KVM: VMX: Fix crash due to uninitialized current_vmcs

KVM enables 'Enlightened VMCS' and 'Enlightened MSR Bitmap' when running as

a nested hypervisor on top of Hyper-V. When MSR bitmap is updated,

evmcs_touch_msr_bitmap function uses current_vmcs per-cpu variable to mark

that the msr bitmap was changed.

vmx_vcpu_create() modifies the msr bitmap via vmx_disable_intercept_for_msr

-> vmx_msr_bitmap_l01_changed which in the end calls this function. The

function checks for current_vmcs if it is null but the check is

insufficient because current_vmcs is not initialized. Because of this, the

code might incorrectly write to the structure pointed by current_vmcs value

left by another task. Preemption is not disabled, the current task can be

preempted and moved to another CPU while current_vmcs is accessed multiple

times from evmcs_touch_msr_bitmap() which leads to crash.

The manipulation of MSR bitmaps by callers happens on

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References