CVE-2020-2732

What it actually does

The KVM hypervisor's instruction emulation for L2 guests under nested virtualization can be tricked into allowing L2 to access sensitive L1 resources that should remain inaccessible.

Why it matters to the business

Organizations running nested virtual machines on affected Red Hat Enterprise Linux systems face risk of unauthorized information disclosure between virtualization layers, potentially exposing sensitive data in multi-tenant or cloud environments.

How an attack unfolds

An attacker with control of an L2 guest crafts specific instructions that exploit the emulation flaw, causing the L0 hypervisor to inadvertently grant access to L1 resources during nested virtualization operations.

How to fix it

Apply the latest KVM and kernel updates from Red Hat for affected Enterprise Linux releases; disable nested virtualization where it is not required.

How to confirm the fix worked

Confirm KVM and kernel package versions match or exceed current Red Hat security advisories; test nested virtualization configurations to ensure the emulation path is hardened.

Typical attack path

1. Obtain control of an L2 guest virtual machine
2. Craft and execute malicious instructions targeting KVM emulation
3. Trigger nested virtualization handling in the L0 hypervisor
4. Access sensitive L1 guest resources

How to detect it

Review hypervisor logs for anomalous instruction emulation events or unexpected cross-layer resource accesses in KVM nested setups.

What your security team should do

• Prioritize patching of Red Hat Enterprise Linux hosts running KVM with nested virtualization enabled
• Audit virtualization configurations to identify and minimize use of nested setups
• Monitor vendor security notices for any backported fixes given the age of the issue