KVM: nVMX: Snapshot pre-VM-Enter BNDCFGS for !nested_run_pending case
Summary
GSD-2022-1005922: KVM: nVMX: Snapshot pre-VM-Enter BNDCFGS for !nested_run_pending case. Affects Kernel versions >= 62cf9bd8118c4009f02c477ef78c723f49e53e16, < ab4805c2638cc1f30697e7e8405c4355a13999ff. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a fundamental component of the Linux operating system that manages system resources and facilitates communication between hardware and software. It provides essential functionality for the proper functioning of the system. This vulnerability affects the Kernel package in the Linux ecosystem. The Kernel package is responsible for managing the core functionalities of the operating system, including process management, memory management, and device drivers. The vulnerability in question impacts the nVMX (nested virtual machine extension) feature of the Kernel, specifically related to snapshotting before VM-Enter BNDCFGS for the !nested_run_pending case.
Vulnerability Detail
The vulnerability arises in the nVMX feature of the Kernel, which is responsible for managing nested virtual machines. In certain scenarios where nested_run_pending is false, the system fails to properly snapshot before VM-Enter BNDCFGS. This flaw could potentially be exploited by an attacker to gain unauthorized access or execute arbitrary code within the virtual machine environment. The impact and attack plausibility of this vulnerability have not been fully proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been provided for this vulnerability.
Conclusion
The vulnerability in the Kernel package, specifically in the nVMX feature related to snapshotting before VM-Enter BNDCFGS for the !nested_run_pending case, has been identified and addressed in the Linux Kernel version v5.10.137. It is crucial to update the Kernel package to the latest version to ensure the security and integrity of the system. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability is not yet fully known. However, it could potentially allow an attacker to gain unauthorized access or execute arbitrary code within the virtual machine environment.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for any open-source vulnerabilities, including this one.
Yes, a patch has been released in the Linux Kernel version v5.10.137. It is recommended to update your Kernel package to the latest version to fix the vulnerability.
The remote exploitability of this vulnerability has not been determined yet. Further analysis is required to assess the potential for remote exploitation.
There are no known instances of this vulnerability being exploited in the wild. However, it is always recommended to apply security patches and updates to mitigate potential risks.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
