CVE-2024-26992

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86/pmu: Disable support for adaptive PEBS

Drop support for virtualizing adaptive PEBS, as KVM's implementation is

architecturally broken without an obvious/easy path forward, and because

exposing adaptive PEBS can leak host LBRs to the guest, i.e. can leak

host kernel addresses to the guest.

Bug #1 is that KVM doesn't account for the upper 32 bits of

IA32_FIXED_CTR_CTRL when (re)programming fixed counters, e.g

fixed_ctrl_field() drops the upper bits, reprogram_fixed_counters()

stores local variables as u8s and truncates the upper bits too, etc.

Bug #2 is that, because KVM _always_ sets precise_ip to a non-zero value

for PEBS events, perf will _always_ generate an adaptive record, even if

the guest requested a basic record. Note, KVM will also enable adaptive

PEBS in individual *counter*, even if adaptive PEBS isn't exposed to the

guest, but this is benign as MSR_PEBS_DATA_CFG is guaranteed to be zero,

i.e. t

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References