CVE-2024-26992

What it actually does

The vulnerability stems from multiple bugs in KVM's adaptive PEBS virtualization that allow a guest to read host LBR MSRs, exposing host kernel instruction pointers and addresses; additional issues include incorrect handling of IA32_FIXED_CTR_CTRL upper bits, forced adaptive records, and potential bypass of PMU event filters.

Why it matters to the business

In virtualized Linux environments, guests could obtain sensitive host kernel memory layout information, raising the risk of further attacks against the hypervisor or other tenants on shared systems; the issue affects kernel stability for live migration but carries low immediate exploitation likelihood.

How an attack unfolds

An attacker controlling a guest VM configures PEBS events with non-zero precise_ip and enables LBR entries recording; due to KVM and perf bugs the guest observes host LBR values containing kernel RIPs instead of guest values or zeros, allowing address space layout disclosure without needing additional privileges beyond guest access.

How to fix it

Upgrade the Linux kernel to a version containing commit 0fb74c00d140a66128afc0003785dcc57e69d312 or later; disable adaptive PEBS virtualization if backporting is required; test live migration behavior after the update.

How to confirm the fix worked

Verify the running kernel contains the fix commit or is newer than the affected stable branches; confirm MSR_PEBS_DATA_CFG remains zero for guests and that LBR MSRs are cleared or hold guest values on vCPU entry; review KVM PMU code for removal of adaptive PEBS support.

Typical attack path

1. Obtain code execution or control inside a KVM guest VM
2. Program performance monitoring events requesting adaptive PEBS via guest MSRs
3. Enable LBR entries recording in the PEBS configuration
4. Read leaked host LBR values containing kernel addresses from the guest
5. Use disclosed addresses to prepare subsequent host-targeted attacks

How to detect it

Inspect guest-initiated writes to IA32_FIXED_CTR_CTRL, MSR_PEBS_DATA_CFG, and LBR-related MSRs; look for perf events with precise_ip set and adaptive PEBS records in kernel logs or tracepoints; correlate with unexpected LBR content containing host kernel addresses.

What your security team should do

• Apply the kernel fix containing commit 0fb74c00d140a66128afc0003785dcc57e69d312 across all affected hosts promptly
• Audit virtualization configurations for any custom PEBS or PMU exposure to guests
• Monitor for guest-initiated PMU MSR writes that request adaptive records
• Re-test live migration after patching to ensure guest stability