CVE-2024-46830

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86: Acquire kvm->srcu when handling KVM_SET_VCPU_EVENTS

Grab kvm->srcu when processing KVM_SET_VCPU_EVENTS, as KVM will forcibly

leave nested VMX/SVM if SMM mode is being toggled, and leaving nested VMX

reads guest memory.

Note, kvm_vcpu_ioctl_x86_set_vcpu_events() can also be called from KVM_RUN

via sync_regs(), which already holds SRCU. I.e. trying to precisely use

kvm_vcpu_srcu_read_lock() around the problematic SMM code would cause

problems. Acquiring SRCU isn't all that expensive, so for simplicity,

grab it unconditionally for KVM_SET_VCPU_EVENTS.

=============================

WARNING: suspicious RCU usage

6.10.0-rc7-332d2c1d713e-next-vm #552 Not tainted

-----------------------------

include/linux/kvm_host.h:1027 suspicious rcu_dereference_check() usage!

other info that might help us debug this:

rcu_scheduler_active = 2, debug_locks = 1

1 lock held by repro/1071:

#0: ffff88811e424430 (&vcpu

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References