https://bugzilla.kernel.org/show_bug.cgi?id=53871
Summary: nVMX: Can malicious L2 kill L1?
Product: Virtualization
Version: unspecified
Platform: All
OS/Version: Linux
Tree: Mainline
Status: NEW
Severity: low
Priority: P1
Component: kvm
AssignedTo: [email protected]
ReportedBy: [email protected]
Regression: No
This is a thought-experiment bug - I haven't seen it happen in practice, so
maybe it's not a bug, but it's worth investigating.
There are, I think, places cases where KVM decides that the guest is buggy or
malicious so it aborts this guest. But because KVM is not aware that L1 and
several L2 (nested guests) are all pretending to be one guest (one vcpu) - this
might mean that a buggy or malicious L2 can kill an entire L1, not just this
L2.
A potential example of this problem is this (I'm not sure it's actually correct
- I just thought of this a long time ago and didn't recheck the details now):
In the original nested VMX submission, After L2 changed cr3, kvm_mmu_load() was
called to realize immediately that L2 did something bad and only it should be
aborted. But after a review, this test was removed, so the code now waits till
later, and when it later sees it can't kvm_mmu_load() I think it kills the
entire vcpu - L1 and all its L2s.
--
Configure bugmail: https://bugzilla.kernel.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.
--
To unsubscribe from this list: send the line "unsubscribe kvm" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
