A vulnerability in the Linux kernel's KVM component allows for guest-triggered alignment issues when handling IOeventfd datamatch signals. This problem arises because KVM's x86 emulator processes memory writes that cross page boundaries or involve emulated MMIO on separate pages. The vulnerability has existed since 2009, triggered by unaligned data accesses that the original code did not properly validate. Exploitation can cause a kernel panic by hitting a BUG_ON() assertion, indicating an invalid opcode error.
Exploitation of this vulnerability leads to a kernel panic, causing a crash of the virtual machine.
To reproduce this vulnerability, create a virtual machine using QEMU with the Standard PC (Q35 + ICH9, 2009) hardware configuration. Then, run a guest that emits a memory store operation splitting across two pages, with the second page having a datamatch-enabled IOeventfd at the start. This will trigger the unaligned access issue, causing the KVM emulator to panic the guest with a 'BUG' error.
Users can upgrade to the latest stable version of the Linux kernel, where this vulnerability has been addressed.
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.
