Cloudanix VulnDB

CVE-2023-53756

None

CVSS

—

EPSS

0.2%

Published

Dec 8, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in the Linux kernel used for running virtual machines can cause the entire computer to crash when certain virtualization features from Microsoft Hyper-V are active.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Uninitialized per-CPU current_vmcs pointer allows evmcs_touch_msr_bitmap to write through a stale or NULL value during MSR bitmap updates in vmx_vcpu_create, causing NULL pointer dereference or cross-task memory corruption and kernel panic.

Why it matters to the business

Unexpected host kernel crashes during virtual machine creation on affected Linux systems running nested under Hyper-V, leading to denial of service and potential data loss for workloads relying on KVM virtualization.

How an attack unfolds

An attacker with the ability to create KVM virtual machines on a nested Hyper-V guest triggers vmx_vcpu_create, which calls into vmx_disable_intercept_for_msr and then evmcs_touch_msr_bitmap without a valid current_vmcs; preemption during repeated accesses to the stale pointer produces the crash. No public exploits or threat actor usage are known.

How to fix it

Upgrade linux-azure packages on Ubuntu 14.04 LTS to version 4.15.0-1123.136~14.04.1 or later. Reboot after installation. Where immediate patching is not possible, avoid nested KVM usage on Hyper-V or disable Enlightened VMCS features if supported by the hypervisor configuration.

How to confirm the fix worked

Confirm the running kernel version matches or exceeds the fixed package, verify that /sys/module/kvm_intel/parameters/enlightened_vmcs no longer permits the vulnerable code path, and test VCPU creation under nested Hyper-V conditions to ensure no crash occurs.

Typical attack path

  1. Obtain local access or control sufficient to issue KVM_CREATE_VCPU ioctl
  2. Trigger vmx_vcpu_create on a system with KVM nested on Hyper-V and Enlightened VMCS enabled
  3. Execute code path that updates MSR bitmaps before current_vmcs is initialized
  4. Cause preemption or cross-CPU migration while evmcs_touch_msr_bitmap dereferences the uninitialized pointer
  5. Induce kernel NULL pointer dereference and panic

How to detect it

Search kernel logs and crash dumps for Oops messages referencing vmx_msr_bitmap_l01_changed or NULL pointer dereference at address 0000000000000338 during kvm_vm_ioctl_create_vcpu; correlate with Hyper-V nested virtualization usage.

What your security team should do

  • Apply the fixed linux-azure kernel package immediately on all Ubuntu 14.04 systems using KVM
  • Prioritize systems running nested virtualization workloads under Hyper-V
  • Monitor for kernel oops reports containing vmx_msr_bitmap_l01_changed after deployment
  • Review virtualization configurations to limit unnecessary nested Hyper-V usage until patched

The record

In the Linux kernel, the following vulnerability has been resolved: KVM: VMX: Fix crash due to uninitialized current_vmcs KVM enables 'Enlightened VMCS' and 'Enlightened MSR Bitmap' when running as a nested hypervisor on top of Hyper-V. When MSR bitmap is updated, evmcs_touch_msr_bitmap function uses current_vmcs per-cpu variable to mark that the msr bitmap was changed. vmx_vcpu_create() modifies the msr bitmap via vmx_disable_intercept_for_msr -> vmx_msr_bitmap_l01_changed which in the end calls this function. The function checks for current_vmcs if it is null but the check is insufficient because current_vmcs is not initialized. Because of this, the code might incorrectly write to the structure pointed by current_vmcs value left by another task. Preemption is not disabled, the current task can be preempted and moved to another CPU while current_vmcs is accessed multiple times from evmcs_touch_msr_bitmap() which leads to crash. The manipulation of MSR bitmaps by callers happens only for vmcs01 so the solution is to use vmx->vmcs01.vmcs instead of current_vmcs. BUG: kernel NULL pointer dereference, address: 0000000000000338 PGD 4e1775067 P4D 0 Oops: 0002 [#1] PREEMPT SMP NOPTI ... RIP: 0010:vmx_msr_bitmap_l01_changed+0x39/0x50 [kvm_intel] ... Call Trace: vmx_disable_intercept_for_msr+0x36/0x260 [kvm_intel] vmx_vcpu_create+0xe6/0x540 [kvm_intel] kvm_arch_vcpu_create+0x1d1/0x2e0 [kvm] kvm_vm_ioctl_create_vcpu+0x178/0x430 [kvm] kvm_vm_ioctl+0x53f/0x790 [kvm] __x64_sys_ioctl+0x8a/0xc0 do_syscall_64+0x5c/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd

Affected packages

Ecosystem Package Introduced Fixed
Linux Kernel 4.18.0 5.10.175

Related vulnerabilities