Linux Kernel KVM Hypercall Handling Vulnerability in Protected Guests

A vulnerability in the Linux kernel's KVM component for x86 architecture has been addressed. The issue arose in the 'complete_hypercall_exit()' function, where the wrong method was used to determine if a hypercall was made in 64-bit mode. This misstep could lead to improper handling of hypercalls for guests in a protected state, such as those using SEV-ES or SEV-SNP, where the necessary vCPU state information is unavailable. The vulnerability was exposed by modifying a self-test to generate a specific hypercall, which triggered a warning about the improper hypercall exit handling.

Impact

Exploitation of this vulnerability could disrupt the normal operation of the KVM hypervisor, particularly in managing hypercalls for protected guests, potentially leading to incorrect guest behavior or state management.

Reproduction

The vulnerability can be reproduced by altering the 'sev_smoke_test' self-test to create a 'KVM_HC_MAP_GPA_RANGE' hypercall through a VM exit. This modification will trigger the 'complete_hypercall_exit()' function, where the vulnerability manifests by improperly handling the hypercall for guests in a protected state.