New: nVMX: Can malicious L2 kill L1?
https://bugzilla.kernel.org/show_bug.cgi?id=53871
Summary: nVMX: Can malicious L2 kill L1?
Product: Virtualization
Version: unspecified
Platform: All
OS/Version: Linux
Tree: Mainline
Status: NEW
Severity: low
Priority: P1
Component: kvm
AssignedTo: [email protected]
ReportedBy: [email protected]
Regression: No
This is a thought-experiment bug - I haven't seen it happen in practice, so maybe it's not a bug, but it's worth investigating.
There are, I think, places cases where KVM decides that the guest is buggy or malicious so it aborts this guest. But because KVM is not aware that L1 and several L2 (nested guests) are all pretending to be one guest (one vcpu) - this might mean that a buggy or malicious L2 can kill an entire L1, not just this L2.
A potential example of this problem is this (I'm not sure it's actually correct
- I just thought of this a long time ago and didn't recheck the details now):
In the original nested VMX submission, After L2 changed cr3, kvm_mmu_load() was called to realize immediately that L2 did something bad and only it should be aborted. But after a review, this test was removed, so the code now waits till later, and when it later sees it can't kvm_mmu_load() I think it kills the entire vcpu - L1 and all its L2s.
Signature · 3 lines
Configure bugmail: https://bugzilla.kernel.org/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching the assignee of the bug.
[Bug 53871] nVMX: Can malicious L2 kill L1?
https://bugzilla.kernel.org/show_bug.cgi?id=53871
Nadav Har'El <[email protected]> changed:
What |Removed |Added
----------------------------------------------------------------------------
Blocks| |53601
Signature · 3 lines
Configure bugmail: https://bugzilla.kernel.org/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching the assignee of the bug.
[Bug 53871] nVMX: Can malicious L2 kill L1?
In reply to [email protected]https://bugzilla.kernel.org/show_bug.cgi?id=53871
Bandan Das <[email protected]> changed:
What |Removed |Added
----------------------------------------------------------------------------
Blocks| |94971
Signature · 2 lines
You are receiving this mail because: You are watching the assignee of the bug.