CVE-2024-53135

A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) subsystem. In guest/host mode for Intel Processor Trace (Intel PT), the hypervisor fails to properly validate virtual processor configurations and manage tracing states during virtual machine transitions. A local user or guest administrator can exploit this issue by supplying unsupported processor configurations or invalid tracing states. This flaw can trigger hardware errors and deadlocks, leading to a Denial of Service (DoS) and host or guest instability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Ensure Intel Processor Trace (Intel PT) guest/host virtualization mode is disabled by configuring the kvm_intel module to use system mode (pt_mode=0), which is the default setting.

1. Check the current module configuration:

cat /sys/module/kvm_intel/parameters/pt_mode

If the output is 0, guest/host mode is not active and the host is not exposed.

2. If the value is 1, disable the feature by configuring /etc/modprobe.d/kvm-intel.conf:

echo "options kvm_intel pt_mode=0" > /etc/modprobe.d/kvm-intel.conf

3. To apply the setting without rebooting the system, reload the kvm_intel module:

modprobe -r kvm_intel
modprobe kvm_intel

Warning: Unloading and reloading the kvm_intel module requires terminating all active virtual machines running on the hypervisor. Setting pt_mode=0 prevents guest operating systems from utilizing Intel Processor Trace capabilities.