Linux KVM/x86 stale SMM MMIO cache bypasses write tracking
Original title: Linux KVM/x86: stale SMM MMIO cache bypasses write tracking
A guest can make a tracked RAM write look like KVM_EXIT_MMIO, so a VMM may change the page without write tracking.
Jinu Kim reported a guest-triggerable write-tracking bypass in KVM/x86’s per-vCPU MMIO cache. On pre-fix mainline, a KVM selftest reproduces a tracked RAM write misreported as KVM_EXIT_MMIO and a warning in kvm_mmu_write_protect_fault(). A VMM that completes that exit against RAM can modify the backing page without KVM write tracking. The note says KVM keeps separate normal and SMM memslot address spaces.
Unconfirmed: The snippet gives no CVE, fixed version, or statement on real-world exploitation.
- The bug is in the per-vCPU MMIO cache on KVM/x86.
- A selftest on pre-fix mainline reproduces the misreported exit.
- The warning is WARN_ON_ONCE() in kvm_mmu_write_protect_fault().
- Normal and SMM memslots use separate address spaces.
Impact: Guest bypasses KVM write tracking of a RAM page
| Product | Affected |
|---|---|
| Linux KVM/x86 | pre-fix mainline |
From the original article
Posted by Jinu Kim on Oct 19 Hello, I found a guest-triggerable write-tracking bypass in KVM/x86's per-vCPU MMIO cache. On pre-fix mainline, a KVM selftest reproduces a tracked RAM write misreported as KVM_EXIT_MMIO and the WARN_ON_ONCE() in kvm_mmu_write_protect_fault(). A VMM completing such an exit against RAM can modify the backing page without KVM write tracking.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.