lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Tue, 3 Oct 2023 10:17:53 +0700
From:   "Suthikulpanit, Suravee" <>
To:     Sean Christopherson <>,
        Maxim Levitsky <>
        "H. Peter Anvin" <>,
        Paolo Bonzini <>,
        Thomas Gleixner <>,
        Borislav Petkov <>, Joerg Roedel <>,,,
        Dave Hansen <>,
        Will Deacon <>, Ingo Molnar <>,
        Robin Murphy <>,
Subject: Re: [PATCH v2 1/4] x86: KVM: SVM: always update the x2avic msr


Thanks for finding and fixing this.

On 9/29/2023 7:24 AM, Sean Christopherson wrote:
> On Thu, Sep 28, 2023, Maxim Levitsky wrote:
>> The following problem exists since x2avic was enabled in the KVM:
>> svm_set_x2apic_msr_interception is called to enable the interception of
> Nit, svm_set_x2apic_msr_interception().
> Definitely not worth another version though.
>> the x2apic msrs.
>> In particular it is called at the moment the guest resets its apic.
>> Assuming that the guest's apic was in x2apic mode, the reset will bring
>> it back to the xapic mode.
>> The svm_set_x2apic_msr_interception however has an erroneous check for
>> '!apic_x2apic_mode()' which prevents it from doing anything in this case.
>> As a result of this, all x2apic msrs are left unintercepted, and that
>> exposes the bare metal x2apic (if enabled) to the guest.
>> Oops.
>> Remove the erroneous '!apic_x2apic_mode()' check to fix that.
>> This fixes CVE-2023-5090
>> Fixes: 4d1d7942e36a ("KVM: SVM: Introduce logic to (de)activate x2AVIC mode")
>> Cc:
>> Signed-off-by: Maxim Levitsky <>
>> ---
> Reviewed-by: Sean Christopherson <>
Reviewed-by: Suravee Suthikulpanit <>
Tested-by: Suravee Suthikulpanit <>

Powered by blists - more mailing lists