CVE-2023-54172

What it actually does

Linux kernel on x86 with Indirect Branch Tracking enabled panics during hypercalls to Hyper-V when the hypercall page lacks an ENDBR64 instruction at its entry point, because hypercalls use an indirect call that violates IBT rules.

Why it matters to the business

Virtual machines hosted on affected Hyper-V versions crash or fail to boot, causing unplanned downtime and loss of availability for workloads running on Linux guests with newer Hyper-V ConfigVersion settings.

How an attack unfolds

An attacker with the ability to trigger hypercalls or simply boot a Linux guest on a vulnerable Hyper-V host causes the kernel to take an IBT violation exception on the first hypercall, resulting in an immediate panic; no special privileges beyond normal guest operation are required.

How to fix it

Upgrade the Linux kernel to a version containing commit 98cccbd0a19a161971bc7f7feb10577adc62c400 or later; alternatively apply the equivalent backport that clears X86_FEATURE_IBT when the hypercall page is missing ENDBR64. Reboot all affected VMs after the kernel update.

How to confirm the fix worked

After patching, confirm the hypercall page starts with ENDBR64 or that the IBT feature bit is cleared in /proc/cpuinfo or via cpuid; attempt a hypercall (e.g., via hv_vmbus or basic Hyper-V tools) and verify the guest remains stable without panic.

Typical attack path

1. Deploy or start a Linux guest VM on Hyper-V with ConfigVersion 9.3 or later
2. Kernel detects X86_FEATURE_IBT but hypercall page does not begin with ENDBR64
3. First hypercall uses indirect call to page entry, triggering IBT exception
4. Kernel panics and VM becomes unavailable

How to detect it

Search kernel logs and dmesg for IBT violation exceptions or hypercall-related panics on Hyper-V guests; look for boot failures immediately after enabling IBT-capable Hyper-V ConfigVersions.

What your security team should do

• Prioritize kernel upgrades on all Hyper-V Linux guests within the next maintenance window
• Monitor for kernel panics containing IBT or hypercall references in dmesg and syslog
• Coordinate with Hyper-V administrators to confirm host ConfigVersion and apply the pending Hyper-V ENDBR64 fix when available