Executive brief
The Linux kernel's KVM hypervisor support for IBM System z (s390) systems contains a memory management bug in the handling of Address Space Control Elements (ASCE). When KVM replaces an ASCE page used by a guest, it fails to initialize a critical index field, causing incorrect memory addresses to be referenced. This can lead to virtual machine crashes when memory pages are unmapped and invalidation notifications are sent with wrong addresses.
Technical details
The vulnerability exists in the s390_replace_asce() function in arch/s390/mm/gmap.c. When allocating a new page for a guest ASCE during replacement, the code fails to set the page structure's index field to 0, as required for ASCE pages. This causes wrong addresses to be passed when notifying page table entry (pte) invalidations. An attacker with the ability to run a guest VM on affected systems can trigger this by unmapping memory in the guest, causing the prefix page to be unmapped and invoking the notifier with incorrect addresses, resulting in validity intercepts that crash the guest VM. The fix is a single-line addition setting page->index = 0 after page allocation. Patches are available in stable kernel branches.
Affected products
- Linux Linux kernel multiple versions (fix backported to stable branches)
Timeline
- 2023-07-05: disclosed: Initial commit date
- 2023-08-03: patched: Backported to stable kernels