Linux Kernel KVM SEV GHCB Scratch Area Length Vulnerability

A vulnerability in the Linux kernel's KVM (Kernel-based Virtual Machine) SEV (Secure Encrypted Virtualization) implementation has been addressed. The issue arose in the management of the GHCB (Guest Hypervisor Communication Block) scratch area length when the area was located in the GHCB shared buffer. The vulnerability could lead to buffer overflows. The problem occurred because KVM initially handled the length correctly for most scenarios, but not for Page State Change (PSC) requests, where the length parameter only indicated the minimum required size. To rectify this, the length parameter has been renamed to better reflect its purpose, and the calculation of the scratch area length has been adjusted to prevent potential buffer overflows.

Impact

Exploitation of this vulnerability could lead to buffer overflows, a common cause of memory corruption issues that can be exploited to execute arbitrary code or cause a denial-of-service condition.

Reproduction

The vulnerability can be reproduced by sending a Page State Change VMGEXIT request to a virtual machine running on KVM with SEV enabled. The KVM hypervisor will incorrectly handle the length of the GHCB scratch area, leading to a buffer overflow.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for upgrading the kernel can be found in the official Linux kernel documentation.