CVE-2023-53663

What it actually does

Allows userspace to trigger a kernel warning (and potential denial of service) in KVM nSVM by writing MSR_AMD64_TSC_RATIO then clearing the TSCRATEMSR CPUID feature before VMRUN, bypassing an assertion instead of a proper check for nested TSC scaling support.

Why it matters to the business

In virtualized Linux environments using KVM on AMD hardware, attackers with local access can repeatedly trigger warnings that may degrade system stability, increase logging overhead, or lead to availability issues in guest VM operations.

How an attack unfolds

An attacker with local access to a KVM guest on AMD SVM uses userspace APIs to set the TSC_RATIO MSR to a non-default value and then removes the corresponding CPUID feature bit; on the next nested VMRUN the missing check causes the kernel to hit a WARN_ON in nested_vmcb02_prepare_control instead of handling the condition gracefully.

How to fix it

Update the Linux kernel to a version containing the fix for CVE-2023-53663 that replaces the assertion with an explicit check; apply the vendor-supplied kernel package for your distribution.

How to confirm the fix worked

Confirm the kernel version contains the corrected nested_vmcb02_prepare_control logic; attempt to reproduce the MSR+CPUID manipulation in a test VM and verify no WARNING is emitted.

Typical attack path

1. Obtain local access or execute code inside a KVM guest on AMD hardware
2. Use vcpu_set_msr to write MSR_AMD64_TSC_RATIO to a divergent value
3. Call vcpu_clear_cpuid_feature to hide X86_FEATURE_TSCRATEMSR from guest CPUID
4. Trigger nested SVM VMRUN (via hypervisor or nested hypervisor setup)
5. Observe kernel warning and potential follow-on effects in the host

How to detect it

Search host kernel logs for the exact warning string nested_vmcb02_prepare_control and the call trace involving nested_svm_vmrun or svm_invoke_exit_handler; correlate with guest MSR writes to MSR_AMD64_TSC_RATIO.

• WARNING: CPU:.*nested_vmcb02_prepare_control
• nested_vmcb02_prepare_control+0x3d6/0x3f0
• MSR_AMD64_TSC_RATIO written before CPUID feature clear

What your security team should do

• Prioritize kernel updates on all AMD KVM hosts within standard patch cycles given low EPSS and non-KEV status
• Monitor for unusual volumes of the specific warning in host dmesg or centralized logging
• Restrict untrusted local access to KVM guests where feasible