CVE-2021-47277

In the Linux kernel, the following vulnerability has been resolved: kvm:
avoid speculation-based attacks from out-of-range memslot accesses KVM’s
mechanism for accessing guest memory translates a guest physical address
(gpa) to a host virtual address using the right-shifted gpa (also known as
gfn) and a struct kvm_memory_slot. The translation is performed in
__gfn_to_hva_memslot using the following formula: hva =
slot->userspace_addr + (gfn - slot->base_gfn) * PAGE_SIZE It is expected
that gfn falls within the boundaries of the guest’s physical memory.
However, a guest can access invalid physical addresses in such a way that
the gfn is invalid. __gfn_to_hva_memslot is called from
kvm_vcpu_gfn_to_hva_prot, which first retrieves a memslot through
__gfn_to_memslot. While __gfn_to_memslot does check that the gfn falls
within the boundaries of the guest’s physical memory or not, a CPU can
speculate the result of the check and continue execution speculatively
using an illegal gfn. The speculation can result in calculating an
out-of-bounds hva. If the resulting host virtual address is used to load
another guest physical address, this is effectively a Spectre gadget
consisting of two consecutive reads, the second of which is data dependent
on the first. Right now it’s not clear if there are any cases in which this
is exploitable. One interesting case was reported by the original author of
this patch, and involves visiting guest page tables on x86. Right now these
are not vulnerable because the hva read goes through get_user(), which
contains an LFENCE speculation barrier. However, there are patches in
progress for x86 uaccess.h to mask kernel addresses instead of using
LFENCE; once these land, a guest could use speculation to read from the
VMM’s ring 3 address space. Other architectures such as ARM already use the
address masking method, and would be susceptible to this same kind of
data-dependent access gadgets. Therefore, this patch proactively protects
from these attacks by masking out-of-bounds gfns in __gfn_to_hva_memslot,
which blocks speculation of invalid hvas. Sean Christopherson noted that
this patch does not cover kvm_read_guest_offset_cached. This however is
limited to a few bytes past the end of the cache, and therefore it is
unlikely to be useful in the context of building a chain of data dependent
accesses.