Linux Formerly Affected By A KVM SVM Guest-To-Host Breakout Code Vulnerability

Linux's KVM virtualization component previously could allow a virtual machine guest relying on AMD SVM virtualization to breakout into the host. This bug persisted in the Linux kernel from late 2020 to March 2021 before being addressed and is the first known issue of such a guest-to-host breakout that didn't also depend upon bugs within user-space components.

Google's Project Zero initiative today published a case study on this guest-to-host breakout issue. This vulnerability doesn't stem from an issue with the AMD EPYC processors but rather a bug that was within the Kernel-based Virtual Machine (KVM) AMD backend code around its SVM nested virtualization handling.

The case study in full can be read on Google's blog and is an interesting technical read for anyone interested in the matter in great detail.

Linux 5.10 and 5.11 were originally affected by this vulnerability tracked as CVE-2021-29657 before being fixed late in the Linux 5.12 cycle and fixes being back-ported to point releases on those prior series. This is troublesome considering most major cloud providers rely on KVM, but at least the bug was short lived within the kernel and just a software bug while in this case one of the fortunate times public/cloud infrastructure doesn't shift too quickly to new kernel versions.

The post concludes with, "This blog post describes a KVM-only VM escape made possible by a small bug in KVM’s AMD-specific code for supporting nested virtualization. Luckily, the feature that made this bug exploitable was only included in two kernel versions (v5.10, v5.11) before the issue was spotted, reducing the real-life impact of the vulnerability to a minimum. The bug and its exploit still serve as a demonstration that highly exploitable security vulnerabilities can still exist in the very core of a virtualization engine, which is almost certainly a small and well audited codebase. While the attack surface of a hypervisor such as KVM is relatively small from a pure LoC perspective, its low level nature, close interaction with hardware and pure complexity makes it very hard to avoid security-critical bugs."

The Google engineers involved call for greater investing in detection capabilities and better isolation of VM hosts. Fortunately, while this software vulnerability was not introduced by AMD engineers, AMD has been hiring more Linux software engineers in recent months and they continue posting new openings, including in the area of virtualization, as they continue improving their Linux software support overall.