Linux KVM Instruction Emulation Issue
Posted by deepcore on August 31, 2022 – 12:36 am
KVM instruction emulation can run while KVM_VCPU_PREEMPTED is set, which can lead other vcpus to skip sending TLB flush IPIs. As a consequence, KVM instruction emulation can access memory through stale translations when the guest kernel thinks it has flushed all cached translations. This could potentially be used by unprivileged userspace inside a guest to compromise the guest kernel.
Post a reply
You must be logged in to post a comment.