CVE-2024-45005

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

KVM: s390: fix validity interception issue when gisa is switched off

We might run into a SIE validity if gisa has been disabled either via using

kernel parameter "kvm.use_gisa=0" or by setting the related sysfs

attribute to N (echo N >/sys/module/kvm/parameters/use_gisa).

The validity is caused by an invalid value in the SIE control block's

gisa designation. That happens because we pass the uninitialized gisa

origin to virt_to_phys() before writing it to the gisa designation.

To fix this we return 0 in kvm_s390_get_gisa_desc() if the origin is 0.

kvm_s390_get_gisa_desc() is used to determine which gisa designation to

set in the SIE control block. A value of 0 in the gisa designation disables

gisa usage.

The issue surfaces in the host kernel with the following kernel message as

soon a new kvm guest start is attemted.

kvm: unhandled validity intercept 0x1011

WARNING: CPU: 0 PID: 781237 at arch/s390/kvm/intercept.c:

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References