In the Linux kernel, the following vulnerability has been resolved:
KVM: Fix a data race on lastboostedvcpu in kvmvcpuon_spin()
Use {READ,WRITE}ONCE() to access kvm->lastboosted_vcpu to ensure the loads and stores are atomic. In the extremely unlikely scenario the compiler tears the stores, it's theoretically possible for KVM to attempt to get a vCPU using an out-of-bounds index, e.g. if the write is split into multiple 8-bit stores, and is paired with a 32-bit load on a VM with 257 vCPUs:
CPU0 CPU1 lastboostedvcpu = 0xff;
(last_boosted_vcpu = 0x100)
last_boosted_vcpu[15:8] = 0x01;
i = (lastboostedvcpu = 0x1ff) lastboostedvcpu[7:0] = 0x00;
vcpu = kvm->vcpu_array[0x1ff];
As detected by KCSAN:
BUG: KCSAN: data-race in kvmvcpuonspin [kvm] / kvmvcpuonspin [kvm]
write to 0xffffc90025a92344 of 4 bytes by task 4340 on cpu 16: kvmvcpuonspin (arch/x86/kvm/../../../virt/kvm/kvmmain.c:4112) kvm handlepause (arch/x86/kvm/vmx/vmx.c:5929) kvmintel vmxhandleexit (arch/x86/kvm/vmx/vmx.c:? arch/x86/kvm/vmx/vmx.c:6606) kvmintel vcpurun (arch/x86/kvm/x86.c:11107 arch/x86/kvm/x86.c:11211) kvm kvmarchvcpuioctlrun (arch/x86/kvm/x86.c:?) kvm kvmvcpuioctl (arch/x86/kvm/../../../virt/kvm/kvmmain.c:?) kvm _sesysioctl (fs/ioctl.c:52 fs/ioctl.c:904 fs/ioctl.c:890) _x64sysioctl (fs/ioctl.c:890) x64syscall (arch/x86/entry/syscall64.c:33) dosyscall64 (arch/x86/entry/common.c:?) entrySYSCALL64afterhwframe (arch/x86/entry/entry_64.S:130)
read to 0xffffc90025a92344 of 4 bytes by task 4342 on cpu 4: kvmvcpuonspin (arch/x86/kvm/../../../virt/kvm/kvmmain.c:4069) kvm handlepause (arch/x86/kvm/vmx/vmx.c:5929) kvmintel vmxhandleexit (arch/x86/kvm/vmx/vmx.c:? arch/x86/kvm/vmx/vmx.c:6606) kvmintel vcpurun (arch/x86/kvm/x86.c:11107 arch/x86/kvm/x86.c:11211) kvm kvmarchvcpuioctlrun (arch/x86/kvm/x86.c:?) kvm kvmvcpuioctl (arch/x86/kvm/../../../virt/kvm/kvmmain.c:?) kvm _sesysioctl (fs/ioctl.c:52 fs/ioctl.c:904 fs/ioctl.c:890) _x64sysioctl (fs/ioctl.c:890) x64syscall (arch/x86/entry/syscall64.c:33) dosyscall64 (arch/x86/entry/common.c:?) entrySYSCALL64afterhwframe (arch/x86/entry/entry_64.S:130)
value changed: 0x00000012 -> 0x00000000
[
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "virt/kvm/kvm_main.c"
},
"digest": {
"line_hashes": [
"220202180276499744833372626975412583977",
"181150883544136394700662880573831574269",
"90162692500220844636538827084474032808",
"57415901970524246426570079256179665735",
"277988979647310927811639130137657021195",
"44953569758604548426735065148947568235",
"36367147385437661359343947077363958392",
"205308867988670578705928021194469641848",
"144625977163928771450205584723069251990",
"331919603294910439314936611721209325246",
"240908246567030449142560630289307106158",
"80686153592519289559127193445341438190"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@82bd728a06e55f5b5f93d10ce67f4fe7e689853a",
"signature_version": "v1",
"id": "CVE-2024-40953-0afe3e64"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "virt/kvm/kvm_main.c",
"function": "kvm_vcpu_on_spin"
},
"digest": {
"length": 863.0,
"function_hash": "316520392013473551787585755709545364688"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@49f683b41f28918df3e51ddc0d928cb2e934ccdb",
"signature_version": "v1",
"id": "CVE-2024-40953-2339cce9"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "virt/kvm/kvm_main.c",
"function": "kvm_vcpu_on_spin"
},
"digest": {
"length": 863.0,
"function_hash": "316520392013473551787585755709545364688"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@92c77807d938145c7c3350c944ef9f39d7f6017c",
"signature_version": "v1",
"id": "CVE-2024-40953-2a0395bd"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "virt/kvm/kvm_main.c",
"function": "kvm_vcpu_on_spin"
},
"digest": {
"length": 863.0,
"function_hash": "316520392013473551787585755709545364688"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a937ef951bba72f48d2402451419d725d70dba20",
"signature_version": "v1",
"id": "CVE-2024-40953-3b5dd4b3"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "virt/kvm/kvm_main.c"
},
"digest": {
"line_hashes": [
"220202180276499744833372626975412583977",
"305421277802793439748147453415059777370",
"248853845408937594305050572207329135764",
"222782126319873904486737873176478592698",
"8101019577378106862571013399158096832",
"207542820349144104524474531536219464211",
"140963010794798019437744277939162371165",
"101150780020010826660180307626137235778",
"144625977163928771450205584723069251990",
"331919603294910439314936611721209325246",
"240908246567030449142560630289307106158",
"80686153592519289559127193445341438190"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@92c77807d938145c7c3350c944ef9f39d7f6017c",
"signature_version": "v1",
"id": "CVE-2024-40953-3d14dccb"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "virt/kvm/kvm_main.c",
"function": "kvm_vcpu_on_spin"
},
"digest": {
"length": 811.0,
"function_hash": "188926556983344857690171654958906983977"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@11a772d5376aa6d3e2e69b5b5c585f79b60c0e17",
"signature_version": "v1",
"id": "CVE-2024-40953-59d5b597"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "virt/kvm/kvm_main.c",
"function": "kvm_vcpu_on_spin"
},
"digest": {
"length": 840.0,
"function_hash": "12106339588587559926946066645593835783"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c141136a28421b78f34969b25a4fa32e06e2180",
"signature_version": "v1",
"id": "CVE-2024-40953-872c7623"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "virt/kvm/kvm_main.c"
},
"digest": {
"line_hashes": [
"220202180276499744833372626975412583977",
"305421277802793439748147453415059777370",
"248853845408937594305050572207329135764",
"222782126319873904486737873176478592698",
"8101019577378106862571013399158096832",
"207542820349144104524474531536219464211",
"140963010794798019437744277939162371165",
"101150780020010826660180307626137235778",
"144625977163928771450205584723069251990",
"331919603294910439314936611721209325246",
"240908246567030449142560630289307106158",
"80686153592519289559127193445341438190"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@95c8dd79f3a14df96b3820b35b8399bd91b2be60",
"signature_version": "v1",
"id": "CVE-2024-40953-89199d3d"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "virt/kvm/kvm_main.c"
},
"digest": {
"line_hashes": [
"220202180276499744833372626975412583977",
"305421277802793439748147453415059777370",
"248853845408937594305050572207329135764",
"222782126319873904486737873176478592698",
"8101019577378106862571013399158096832",
"207542820349144104524474531536219464211",
"140963010794798019437744277939162371165",
"101150780020010826660180307626137235778",
"144625977163928771450205584723069251990",
"331919603294910439314936611721209325246",
"240908246567030449142560630289307106158",
"80686153592519289559127193445341438190"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@49f683b41f28918df3e51ddc0d928cb2e934ccdb",
"signature_version": "v1",
"id": "CVE-2024-40953-9bb75651"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "virt/kvm/kvm_main.c",
"function": "kvm_vcpu_on_spin"
},
"digest": {
"length": 842.0,
"function_hash": "20699383699665589156788477369053508607"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@71fbc3af3dacb26c3aa2f30bb3ab05c44d082c84",
"signature_version": "v1",
"id": "CVE-2024-40953-ad4ba319"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "virt/kvm/kvm_main.c"
},
"digest": {
"line_hashes": [
"220202180276499744833372626975412583977",
"305421277802793439748147453415059777370",
"248853845408937594305050572207329135764",
"222782126319873904486737873176478592698",
"8101019577378106862571013399158096832",
"207542820349144104524474531536219464211",
"140963010794798019437744277939162371165",
"101150780020010826660180307626137235778",
"144625977163928771450205584723069251990",
"331919603294910439314936611721209325246",
"240908246567030449142560630289307106158",
"80686153592519289559127193445341438190"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a937ef951bba72f48d2402451419d725d70dba20",
"signature_version": "v1",
"id": "CVE-2024-40953-b153f368"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "virt/kvm/kvm_main.c",
"function": "kvm_vcpu_on_spin"
},
"digest": {
"length": 863.0,
"function_hash": "316520392013473551787585755709545364688"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@95c8dd79f3a14df96b3820b35b8399bd91b2be60",
"signature_version": "v1",
"id": "CVE-2024-40953-c51929ef"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "virt/kvm/kvm_main.c"
},
"digest": {
"line_hashes": [
"220202180276499744833372626975412583977",
"181150883544136394700662880573831574269",
"90162692500220844636538827084474032808",
"57415901970524246426570079256179665735",
"277988979647310927811639130137657021195",
"44953569758604548426735065148947568235",
"36367147385437661359343947077363958392",
"205308867988670578705928021194469641848",
"144625977163928771450205584723069251990",
"331919603294910439314936611721209325246",
"240908246567030449142560630289307106158",
"80686153592519289559127193445341438190"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c141136a28421b78f34969b25a4fa32e06e2180",
"signature_version": "v1",
"id": "CVE-2024-40953-cb3bedb0"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "virt/kvm/kvm_main.c"
},
"digest": {
"line_hashes": [
"220202180276499744833372626975412583977",
"181150883544136394700662880573831574269",
"90162692500220844636538827084474032808",
"57415901970524246426570079256179665735",
"277988979647310927811639130137657021195",
"44953569758604548426735065148947568235",
"36367147385437661359343947077363958392",
"205308867988670578705928021194469641848",
"144625977163928771450205584723069251990",
"331919603294910439314936611721209325246",
"240908246567030449142560630289307106158",
"80686153592519289559127193445341438190"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@71fbc3af3dacb26c3aa2f30bb3ab05c44d082c84",
"signature_version": "v1",
"id": "CVE-2024-40953-e3520a7e"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "virt/kvm/kvm_main.c"
},
"digest": {
"line_hashes": [
"220202180276499744833372626975412583977",
"181150883544136394700662880573831574269",
"90162692500220844636538827084474032808",
"57415901970524246426570079256179665735",
"277988979647310927811639130137657021195",
"44953569758604548426735065148947568235",
"36367147385437661359343947077363958392",
"205308867988670578705928021194469641848",
"144625977163928771450205584723069251990",
"331919603294910439314936611721209325246",
"240908246567030449142560630289307106158",
"80686153592519289559127193445341438190"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@11a772d5376aa6d3e2e69b5b5c585f79b60c0e17",
"signature_version": "v1",
"id": "CVE-2024-40953-edd7019b"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "virt/kvm/kvm_main.c",
"function": "kvm_vcpu_on_spin"
},
"digest": {
"length": 864.0,
"function_hash": "160422302071645734938511242608855745717"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@82bd728a06e55f5b5f93d10ce67f4fe7e689853a",
"signature_version": "v1",
"id": "CVE-2024-40953-fabc72cc"
}
]