Linux Formerly Affected By A KVM SVM Guest-To-Host Breakout Code Vulnerability
Written by Michael Larabel in AMD on 29 June 2021 at 02:00 PM EDT. 2 Comments
AMD --
Linux's KVM virtualization component previously could allow a virtual machine guest relying on AMD SVM virtualization to breakout into the host. This bug persisted in the Linux kernel from late 2020 to March 2021 before being addressed and is the first known issue of such a guest-to-host breakout that didn't also depend upon bugs within user-space components.

Google's Project Zero initiative today published a case study on this guest-to-host breakout issue. This vulnerability doesn't stem from an issue with the AMD EPYC processors but rather a bug that was within the Kernel-based Virtual Machine (KVM) AMD backend code around its SVM nested virtualization handling.

The case study in full can be read on Google's blog and is an interesting technical read for anyone interested in the matter in great detail.

Linux 5.10 and 5.11 were originally affected by this vulnerability tracked as CVE-2021-29657 before being fixed late in the Linux 5.12 cycle and fixes being back-ported to point releases on those prior series. This is troublesome considering most major cloud providers rely on KVM, but at least the bug was short lived within the kernel and just a software bug while in this case one of the fortunate times public/cloud infrastructure doesn't shift too quickly to new kernel versions.

The post concludes with, "This blog post describes a KVM-only VM escape made possible by a small bug in KVM’s AMD-specific code for supporting nested virtualization. Luckily, the feature that made this bug exploitable was only included in two kernel versions (v5.10, v5.11) before the issue was spotted, reducing the real-life impact of the vulnerability to a minimum. The bug and its exploit still serve as a demonstration that highly exploitable security vulnerabilities can still exist in the very core of a virtualization engine, which is almost certainly a small and well audited codebase. While the attack surface of a hypervisor such as KVM is relatively small from a pure LoC perspective, its low level nature, close interaction with hardware and pure complexity makes it very hard to avoid security-critical bugs."

The Google engineers involved call for greater investing in detection capabilities and better isolation of VM hosts. Fortunately, while this software vulnerability was not introduced by AMD engineers, AMD has been hiring more Linux software engineers in recent months and they continue posting new openings, including in the area of virtualization, as they continue improving their Linux software support overall.
Related News
About The Author
Author picture

Michael Larabel is the principal author of Phoronix.com and founded the site in 2004 with a focus on enriching the Linux hardware experience. Michael has written more than 20,000 articles covering the state of Linux hardware support, Linux performance, graphics drivers, and other topics. Michael is also the lead developer of the Phoronix Test Suite, Phoromatic, and OpenBenchmarking.org automated benchmarking software. He can be followed via Twitter or contacted via MichaelLarabel.com.

Popular News This Week