KVM L1 guest escape - CVE-2018-12904

[Marcus Meissner <meissner () suse de>]

Hi,

KVM in Linux Kernel between 4.12 and 4.18rc1 has a guest escape allowing
privilege escalation, found by Felix Wilhelm of Google Project Zero.

mitre entry:

[Suggested description]
In
arch/x86/kvm/vmx.c in
the Linux kernel before 4.17.2, when nested virtualization is used,
local attackers could cause L1 KVM guests to VMEXIT, potentially
allowing privilege escalations and denial of service attacks due to
lack of checking of CPL.

------------------------------------------

[Vulnerability Type]
Incorrect Access Control

------------------------------------------

[Vendor of Product]
Linux

------------------------------------------

[Affected Product Code Base]
Kernel - before 4.18.rc1

------------------------------------------

[Affected Component]
KVM implementation in the Linux Kernel

------------------------------------------

[Attack Type]
Local

------------------------------------------

[Impact Denial of Service]
true

------------------------------------------

[Impact Escalation of Privileges]
true

------------------------------------------

[Attack Vectors]
local attacker able to execute code

------------------------------------------

[Reference]
https://bugs.chromium.org/p/project-zero/issues/detail?id=1589
https://github.com/torvalds/linux/commit/727ba748e110b4de50d142edca9d6a9b7e6111d8
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=727ba748e110b4de50d142edca9d6a9b7e6111d8
https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.17.2

------------------------------------------

[Has vendor confirmed or acknowledged the vulnerability?]
true

------------------------------------------

[Discoverer]
Felix Wilhelm of Google Project Zero