CVE-2024-46830

A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) component. This vulnerability occurs when the system processes virtual CPU events, particularly during nested virtualization operations involving System Management Mode (SMM). An attacker with local access could exploit this to read sensitive guest memory, potentially leading to information disclosure or system instability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, disable nested virtualization if it is not required. This can be achieved by setting the nested module parameter to 0 for the kvm_intel or kvm_amd modules, depending on the host CPU.

For kvm_intel: echo "options kvm_intel nested=0" > /etc/modprobe.d/kvm_intel.conf rmmod kvm_intel modprobe kvm_intel

For kvm_amd: echo "options kvm_amd nested=0" > /etc/modprobe.d/kvm_amd.conf rmmod kvm_amd modprobe kvm_amd

A system reboot is recommended to ensure the module is reloaded with the new option. Disabling nested virtualization will prevent guest virtual machines from running their own virtual machines.