CVE-2024-46830

What it actually does

Missing kvm->srcu acquisition in KVM_SET_VCPU_EVENTS allows nested VMX/SVM teardown code to read guest memory without holding the required RCU read-side critical section, triggering suspicious RCU dereference warnings and potential use-after-free or invalid memory access during SMM mode transitions.

Why it matters to the business

Virtualized Linux hosts may experience guest or host crashes, data corruption, or local privilege escalation in environments running nested virtualization, increasing operational risk and requiring urgent patching of affected kernel versions.

How an attack unfolds

An attacker with local access crafts a sequence of KVM_RUN and KVM_SET_VCPU_EVENTS ioctls that toggle SMM while nested virtualization is active; the missing SRCU lock permits the nested teardown path to dereference stale guest memory mappings, which can be abused for memory corruption or information disclosure.

How to fix it

Upgrade the Linux kernel to a fixed version such as 5.15.198 or apply the commit 5f35099fa3d59caf10bda88b033538e90086684e; rebuild and reboot all affected hosts. Where immediate upgrade is impossible, restrict unprivileged access to /dev/kvm and disable nested virtualization where not required.

How to confirm the fix worked

Confirm the running kernel contains the fix by checking the presence of the srcu acquisition around kvm_vcpu_ioctl_x86_set_vcpu_events and verify no RCU warnings appear in dmesg when exercising KVM_SET_VCPU_EVENTS under nested SMM transitions.

Typical attack path

1. Obtain local unprivileged access on a KVM host supporting nested virtualization
2. Create or attach to a VM with nested VMX/SVM enabled
3. Issue KVM_SET_VCPU_EVENTS ioctl (or trigger via sync_regs in KVM_RUN) that toggles SMM mode
4. Force nested VM exit during the SMM transition to trigger vmx_leave_nested and guest memory reads without SRCU protection
5. Leverage resulting memory access for corruption or leak primitives

How to detect it

Search kernel logs and dmesg for RCU warnings referencing kvm_vcpu_gfn_to_memslot or nested_vmx_load_msr during KVM ioctls; inspect audit logs for unusual sequences of KVM_SET_VCPU_EVENTS or KVM_RUN calls from unprivileged processes.

What your security team should do

• Prioritize patching of all KVM hosts to the fixed kernel versions within the next maintenance window
• Audit systems for nested virtualization usage and limit /dev/kvm access to trusted processes only
• Monitor kernel logs for RCU suspicious usage warnings related to kvm_vcpu_gfn_to_memslot during VCPU event handling
• Test the patched kernel in a staging environment with nested VM workloads before broad deployment