CVE-2024-50115 KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory
A flaw in Linux kernel KVM nested SVM allows out-of-bounds reads, potentially disclosing sensitive memory contents to attackers.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-50115?
CVE-2024-50115 is a high-severity vulnerability in Linux kernel, published on 5 Nov 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory
Ignore nCR3[4:0] when loading PDPTEs from memory for nested SVM, as bits 4:0 of CR3 are ignored when PAE paging is used, and thus VMRUN doesn't enforce 32-byte alignment of nCR3.
In the absolute worst case scenario, failure to ignore bits 4:0 can result in an out-of-bounds read, e.g. if the target page is at the end of a memslot, and the VMM isn't using guard pages.
Per the APM:
The CR3 register points to the base address of the page-directory-pointer table. The page-directory-pointer table is aligned on a 32-byte boundary, with the low 5 address bits 4:0 assumed to be 0.
And the SDM's much more explicit:
4:0 Ignored
Note, KVM gets this right when loading PDPTRs, it's only the nSVM flow that is broken.
Weakness: CWE-125
Which versions are affected by CVE-2024-50115?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-50115?
Apply the vendor's patch.
Is CVE-2024-50115 being exploited?
There is no known exploitation of CVE-2024-50115 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-52464, AZL-52529, BELL-CVE-2024-50115, DEBIAN-CVE-2024-50115, GHSA-mjgv-4grg-pfrr, UBUNTU-CVE-2024-50115.