CVE-2023-30456

What it actually does

Missing consistency checks for CR0 and CR4 registers in nested VMX virtualization allow invalid processor states to be loaded without validation.

Why it matters to the business

Virtualized workloads on affected systems may experience unexpected crashes or denial of service, increasing operational downtime in environments relying on nested virtualization.

How an attack unfolds

An attacker with local access on a system using nested virtualization configures a guest VM with inconsistent CR0 or CR4 values that bypass the missing checks in the KVM nVMX code, leading to a host crash or instability.

How to fix it

Upgrade the Linux kernel to version 6.2.8 or later on all affected systems; apply the fixed package versions provided by the distribution for the kernel component.

How to confirm the fix worked

Confirm the running kernel version is 6.2.8 or newer and verify that nested VMX consistency checks are present in arch/x86/kvm/vmx/nested.c.

Typical attack path

1. Gain local user access on the target host
2. Enable and configure nested virtualization features
3. Load a guest with crafted CR0 or CR4 register values
4. Trigger the nVMX path to cause inconsistency and crash

How to detect it

Review kernel logs for crashes related to KVM or VMX nested virtualization; look for unexpected reboots or oops messages after guest VM launches on systems with nested virtualization enabled.

What your security team should do

• Prioritize kernel updates on systems using nested virtualization
• Disable nested virtualization where not required
• Monitor for kernel stability issues in virtualized workloads