2.6 KiB
CVE-2025-38351
Description
In the Linux kernel, the following vulnerability has been resolved:KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flushIn KVM guests with Hyper-V hypercalls enabled, the hypercallsHVCALL_FLUSH_VIRTUAL_ADDRESS_LIST and HVCALL_FLUSH_VIRTUAL_ADDRESS_LIST_EXallow a guest to request invalidation of portions of a virtual TLB.For this, the hypercall parameter includes a list of GVAs that are supposedto be invalidated.However, when non-canonical GVAs are passed, there is currently nofiltering in place and they are eventually passed to checked invocations ofINVVPID on Intel / INVLPGA on AMD. While AMD's INVLPGA silently ignoresnon-canonical addresses (effectively a no-op), Intel's INVVPID explicitlysignals VM-Fail and ultimately triggers the WARN_ONCE in invvpid_error(): invvpid failed: ext=0x0 vpid=1 gva=0xaaaaaaaaaaaaa000 WARNING: CPU: 6 PID: 326 at arch/x86/kvm/vmx/vmx.c:482 invvpid_error+0x91/0xa0 [kvm_intel] Modules linked in: kvm_intel kvm 9pnet_virtio irqbypass fuse CPU: 6 UID: 0 PID: 326 Comm: kvm-vm Not tainted 6.15.0 #14 PREEMPT(voluntary) RIP: 0010:invvpid_error+0x91/0xa0 [kvm_intel] Call Trace: vmx_flush_tlb_gva+0x320/0x490 [kvm_intel] kvm_hv_vcpu_flush_tlb+0x24f/0x4f0 [kvm] kvm_arch_vcpu_ioctl_run+0x3013/0x5810 [kvm]Hyper-V documents that invalid GVAs (those that are beyond a partition'sGVA space) are to be ignored. While not completely clear whether thisruling also applies to non-canonical GVAs, it is likely fine to make thatassumption, and manual testing on Azure confirms "real" Hyper-V interpretsthe specification in the same way.Skip non-canonical GVAs when processing the list of address to avoidtripping the INVVPID failure. Alternatively, KVM could filter out "bad"GVAs before inserting into the FIFO, but practically speaking the onlydownside of pushing validation to the final processing is that doing sois suboptimal for the guest, and no well-behaved guest will request TLBflushes for non-canonical addresses.
POC
Reference
No PoCs from references.