CVE-2024-53135

What it actually does

KVM's Intel PT guest/host virtualization fails to disable tracing before VM-Enter (violating VMX consistency checks) and does not validate guest CPUID, causing passthrough/save/load of non-existent MSRs that trigger host ToPA errors, warnings, and potential deadlocks.

Why it matters to the business

Virtualized workloads on affected Linux kernels may experience guest crashes or host instability when Intel PT virtualization is enabled, increasing operational risk and downtime for environments relying on KVM.

How an attack unfolds

An attacker supplies a malicious guest CPUID configuration enumerating unsupported PT address ranges or leaves tracing enabled; KVM then attempts invalid MSR operations at VM-Enter/Exit, producing host errors or guest fatalities.

How to fix it

Upgrade the Linux kernel to commit c3742319d021f5aa3a0a8c828485fee14753f6de or later; rebuild with CONFIG_BROKEN=n to keep pt_mode disabled, or set pt_mode=0 at runtime if the module parameter remains visible.

How to confirm the fix worked

Verify kernel version contains the fix commit, confirm CONFIG_BROKEN is not enabled, and test that loading a guest with extended PT CPUID no longer produces ToPA ERROR or MSR warnings on VM entry.

Typical attack path

1. Obtain local access or control a guest VM
2. Configure guest CPUID to report more PT ranges than hardware supports
3. Enable or leave IA32_RTIT_CTL.TraceEn set
4. Trigger VM-Enter to induce consistency-check failure or MSR faults

How to detect it

Search kernel logs and dmesg for ToPA ERROR messages, KVM MSR load/save warnings, and IA32_RTIT_CTL consistency-check failures around VM entry events.

• ToPA ERROR
• KVM: failed to load MSR
• IA32_RTIT_CTL.TraceEn
• guest CPUID PT range validation

What your security team should do

• Prioritize kernel updates on all KVM hosts within the next maintenance window
• Audit pt_mode module parameter usage and disable Intel PT virtualization
• Monitor host dmesg and kernel logs for ToPA ERROR and MSR WARN messages until patched