]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
x86/vmscape: Enumerate VMSCAPE bug
authorPawan Gupta <pawan.kumar.gupta@linux.intel.com>
Thu, 14 Aug 2025 17:20:42 +0000 (10:20 -0700)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 11 Sep 2025 15:16:06 +0000 (17:16 +0200)
commite3e6bcf3284b5cd4d0ea6f672742c22fa0753db7
tree7df6ad0e907241cd4b3fb7c5c4bb9503b695aebb
parent28fbc7eddc481f8f3fbb16b01f9f8f5c6f2f14e3
x86/vmscape: Enumerate VMSCAPE bug

commit a508cec6e5215a3fbc7e73ae86a5c5602187934d upstream.

The VMSCAPE vulnerability may allow a guest to cause Branch Target
Injection (BTI) in userspace hypervisors.

Kernels (both host and guest) have existing defenses against direct BTI
attacks from guests. There are also inter-process BTI mitigations which
prevent processes from attacking each other. However, the threat in this
case is to a userspace hypervisor within the same process as the attacker.

Userspace hypervisors have access to their own sensitive data like disk
encryption keys and also typically have access to all guest data. This
means guest userspace may use the hypervisor as a confused deputy to attack
sensitive guest kernel data. There are no existing mitigations for these
attacks.

Introduce X86_BUG_VMSCAPE for this vulnerability and set it on affected
Intel and AMD CPUs.

Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Reviewed-by: Borislav Petkov (AMD) <bp@alien8.de>
[Amit:
 * Drop unsupported Intel families: ARROWLAKE, LUNARLAKE, METEORLAKE,
   GRANITERAPIDS_X, EMERALDRAPIDS_X, ATOM_CRESTMONT_X; and unlisted ATOM
   types for RAPTORLAKE and ALDERLAKE
 * s/ATOM_GRACEMONT/ALDERLAKE_N/
 * Drop unsupported AMD family: 0x1a]
Signed-off-by: Amit Shah <amit.shah@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
arch/x86/include/asm/cpufeatures.h
arch/x86/kernel/cpu/common.c