Linux Kernel KVM ZCR_EL2 Capping Vulnerability in Arm64 VHE Guest Hypervisors

A vulnerability exists in the Linux kernel's handling of the SVE Control Register (ZCR_EL2) for arm64 virtual machines. When a VHE guest hypervisor updates ZCR_EL2, the kernel improperly manages the ZCR_EL2.LEN field, which can disrupt software relying on its full, stateful representation. The issue arises because KVM treats ZCR_EL2 and ZCR_EL1 accesses inconsistently: ZCR_EL2 traps are immediately capped at the virtual machine's vector length limit, while ZCR_EL1 accesses are ignored. This mismanagement can allow an L2 guest to access vector lengths it shouldn't, particularly if the guest hypervisor uses ZCR_EL1 to update the register. The vulnerability has been addressed by ensuring that ZCR_EL2 is always programmed with a capped value, regardless of the access method, and by making ZCR_EL2 a sanitized register that only allows the LEN field to be stateful.

Impact

Exploitation of this vulnerability could lead to incorrect handling of vector length settings in nested virtual machines, potentially allowing access to vector lengths that should be restricted.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for downloading the patched version are available on the Linux Kernel Archives.