CVE-2024-26992

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> KVM: x86/pmu: Disable support for adaptive PEBS<br /> <br /> Drop support for virtualizing adaptive PEBS, as KVM&amp;#39;s implementation is<br /> architecturally broken without an obvious/easy path forward, and because<br /> exposing adaptive PEBS can leak host LBRs to the guest, i.e. can leak<br /> host kernel addresses to the guest.<br /> <br /> Bug #1 is that KVM doesn&amp;#39;t account for the upper 32 bits of<br /> IA32_FIXED_CTR_CTRL when (re)programming fixed counters, e.g<br /> fixed_ctrl_field() drops the upper bits, reprogram_fixed_counters()<br /> stores local variables as u8s and truncates the upper bits too, etc.<br /> <br /> Bug #2 is that, because KVM _always_ sets precise_ip to a non-zero value<br /> for PEBS events, perf will _always_ generate an adaptive record, even if<br /> the guest requested a basic record. Note, KVM will also enable adaptive<br /> PEBS in individual *counter*, even if adaptive PEBS isn&amp;#39;t exposed to the<br /> guest, but this is benign as MSR_PEBS_DATA_CFG is guaranteed to be zero,<br /> i.e. the guest will only ever see Basic records.<br /> <br /> Bug #3 is in perf. intel_pmu_disable_fixed() doesn&amp;#39;t clear the upper<br /> bits either, i.e. leaves ICL_FIXED_0_ADAPTIVE set, and<br /> intel_pmu_enable_fixed() effectively doesn&amp;#39;t clear ICL_FIXED_0_ADAPTIVE<br /> either. I.e. perf _always_ enables ADAPTIVE counters, regardless of what<br /> KVM requests.<br /> <br /> Bug #4 is that adaptive PEBS *might* effectively bypass event filters set<br /> by the host, as "Updated Memory Access Info Group" records information<br /> that might be disallowed by userspace via KVM_SET_PMU_EVENT_FILTER.<br /> <br /> Bug #5 is that KVM doesn&amp;#39;t ensure LBR MSRs hold guest values (or at least<br /> zeros) when entering a vCPU with adaptive PEBS, which allows the guest<br /> to read host LBRs, i.e. host RIPs/addresses, by enabling "LBR Entries"<br /> records.<br /> <br /> Disable adaptive PEBS support as an immediate fix due to the severity of<br /> the LBR leak in particular, and because fixing all of the bugs will be<br /> non-trivial, e.g. not suitable for backporting to stable kernels.<br /> <br /> Note! This will break live migration, but trying to make KVM play nice<br /> with live migration would be quite complicated, wouldn&amp;#39;t be guaranteed to<br /> work (i.e. KVM might still kill/confuse the guest), and it&amp;#39;s not clear<br /> that there are any publicly available VMMs that support adaptive PEBS,<br /> let alone live migrate VMs that support adaptive PEBS, e.g. QEMU doesn&amp;#39;t<br /> support PEBS in any capacity.