Jim found several bugs that allowed L2 to read L0's x2APIC MSRs and write to TPR, EOI, and SELF_IPI, in the worst case.
The fix is split into two patches as possible causes were introduced by two different commits. I have not Cc'd stable as the patches are quite long and nVMX is not considered to be ready for production, yet. Radim Krčmář (2): KVM: nVMX: fix msr bitmaps to prevent L2 from accessing L0 x2APIC KVM: nVMX: postpone VMCS changes on MSR_IA32_APICBASE write arch/x86/kvm/vmx.c | 120 +++++++++++++++++++++++++---------------------------- 1 file changed, 57 insertions(+), 63 deletions(-) -- 2.9.2
