CVE-2025-37936 (GCVE-0-2025-37936)
Vulnerability from cvelistv5
Published
2025-05-20 15:22
Modified
2025-05-26 05:24
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU's value. When generating the MSR_IA32_PEBS_ENABLE value that will be loaded on VM-Entry to a KVM guest, mask the value with the vCPU's desired PEBS_ENABLE value. Consulting only the host kernel's host vs. guest masks results in running the guest with PEBS enabled even when the guest doesn't want to use PEBS. Because KVM uses perf events to proxy the guest virtual PMU, simply looking at exclude_host can't differentiate between events created by host userspace, and events created by KVM on behalf of the guest. Running the guest with PEBS unexpectedly enabled typically manifests as crashes due to a near-infinite stream of #PFs. E.g. if the guest hasn't written MSR_IA32_DS_AREA, the CPU will hit page faults on address '0' when trying to record PEBS events. The issue is most easily reproduced by running `perf kvm top` from before commit 7b100989b4f6 ("perf evlist: Remove __evlist__add_default") (after which, `perf kvm top` effectively stopped using PEBS). The userspace side of perf creates a guest-only PEBS event, which intel_guest_get_msrs() misconstrues a guest-*owned* PEBS event. Arguably, this is a userspace bug, as enabling PEBS on guest-only events simply cannot work, and userspace can kill VMs in many other ways (there is no danger to the host). However, even if this is considered to be bad userspace behavior, there's zero downside to perf/KVM restricting PEBS to guest-owned events. Note, commit 854250329c02 ("KVM: x86/pmu: Disable guest PEBS temporarily in two rare situations") fixed the case where host userspace is profiling KVM *and* userspace, but missed the case where userspace is profiling only KVM.
References
Impacted products
Vendor Product Version
Linux Linux Version: c59a1f106f5cd4843c097069ff1bb2ad72103a67
Version: c59a1f106f5cd4843c097069ff1bb2ad72103a67
Version: c59a1f106f5cd4843c097069ff1bb2ad72103a67
Version: c59a1f106f5cd4843c097069ff1bb2ad72103a67
Version: c59a1f106f5cd4843c097069ff1bb2ad72103a67
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/events/intel/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "160153cf9e4aa875ad086cc094ce34aac8e13d63",
              "status": "affected",
              "version": "c59a1f106f5cd4843c097069ff1bb2ad72103a67",
              "versionType": "git"
            },
            {
              "lessThan": "34b6fa11431aef71045ae5a00d90a7d630597eda",
              "status": "affected",
              "version": "c59a1f106f5cd4843c097069ff1bb2ad72103a67",
              "versionType": "git"
            },
            {
              "lessThan": "44ee0afc9d1e7a7c1932698de01362ed80cfc4b5",
              "status": "affected",
              "version": "c59a1f106f5cd4843c097069ff1bb2ad72103a67",
              "versionType": "git"
            },
            {
              "lessThan": "86aa62895fc2fb7ab09d7ca40fae8ad09841f66b",
              "status": "affected",
              "version": "c59a1f106f5cd4843c097069ff1bb2ad72103a67",
              "versionType": "git"
            },
            {
              "lessThan": "58f6217e5d0132a9f14e401e62796916aa055c1b",
              "status": "affected",
              "version": "c59a1f106f5cd4843c097069ff1bb2ad72103a67",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/events/intel/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.138",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.90",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.28",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.138",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.90",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.28",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.6",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU\u0027s value.\n\nWhen generating the MSR_IA32_PEBS_ENABLE value that will be loaded on\nVM-Entry to a KVM guest, mask the value with the vCPU\u0027s desired PEBS_ENABLE\nvalue.  Consulting only the host kernel\u0027s host vs. guest masks results in\nrunning the guest with PEBS enabled even when the guest doesn\u0027t want to use\nPEBS.  Because KVM uses perf events to proxy the guest virtual PMU, simply\nlooking at exclude_host can\u0027t differentiate between events created by host\nuserspace, and events created by KVM on behalf of the guest.\n\nRunning the guest with PEBS unexpectedly enabled typically manifests as\ncrashes due to a near-infinite stream of #PFs.  E.g. if the guest hasn\u0027t\nwritten MSR_IA32_DS_AREA, the CPU will hit page faults on address \u00270\u0027 when\ntrying to record PEBS events.\n\nThe issue is most easily reproduced by running `perf kvm top` from before\ncommit 7b100989b4f6 (\"perf evlist: Remove __evlist__add_default\") (after\nwhich, `perf kvm top` effectively stopped using PEBS).\tThe userspace side\nof perf creates a guest-only PEBS event, which intel_guest_get_msrs()\nmisconstrues a guest-*owned* PEBS event.\n\nArguably, this is a userspace bug, as enabling PEBS on guest-only events\nsimply cannot work, and userspace can kill VMs in many other ways (there\nis no danger to the host).  However, even if this is considered to be bad\nuserspace behavior, there\u0027s zero downside to perf/KVM restricting PEBS to\nguest-owned events.\n\nNote, commit 854250329c02 (\"KVM: x86/pmu: Disable guest PEBS temporarily\nin two rare situations\") fixed the case where host userspace is profiling\nKVM *and* userspace, but missed the case where userspace is profiling only\nKVM."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-26T05:24:05.383Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/160153cf9e4aa875ad086cc094ce34aac8e13d63"
        },
        {
          "url": "https://git.kernel.org/stable/c/34b6fa11431aef71045ae5a00d90a7d630597eda"
        },
        {
          "url": "https://git.kernel.org/stable/c/44ee0afc9d1e7a7c1932698de01362ed80cfc4b5"
        },
        {
          "url": "https://git.kernel.org/stable/c/86aa62895fc2fb7ab09d7ca40fae8ad09841f66b"
        },
        {
          "url": "https://git.kernel.org/stable/c/58f6217e5d0132a9f14e401e62796916aa055c1b"
        }
      ],
      "title": "perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU\u0027s value.",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-37936",
    "datePublished": "2025-05-20T15:22:00.557Z",
    "dateReserved": "2025-04-16T04:51:23.971Z",
    "dateUpdated": "2025-05-26T05:24:05.383Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-37936\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-05-20T16:15:30.443\",\"lastModified\":\"2025-05-21T20:25:16.407\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nperf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU\u0027s value.\\n\\nWhen generating the MSR_IA32_PEBS_ENABLE value that will be loaded on\\nVM-Entry to a KVM guest, mask the value with the vCPU\u0027s desired PEBS_ENABLE\\nvalue.  Consulting only the host kernel\u0027s host vs. guest masks results in\\nrunning the guest with PEBS enabled even when the guest doesn\u0027t want to use\\nPEBS.  Because KVM uses perf events to proxy the guest virtual PMU, simply\\nlooking at exclude_host can\u0027t differentiate between events created by host\\nuserspace, and events created by KVM on behalf of the guest.\\n\\nRunning the guest with PEBS unexpectedly enabled typically manifests as\\ncrashes due to a near-infinite stream of #PFs.  E.g. if the guest hasn\u0027t\\nwritten MSR_IA32_DS_AREA, the CPU will hit page faults on address \u00270\u0027 when\\ntrying to record PEBS events.\\n\\nThe issue is most easily reproduced by running `perf kvm top` from before\\ncommit 7b100989b4f6 (\\\"perf evlist: Remove __evlist__add_default\\\") (after\\nwhich, `perf kvm top` effectively stopped using PEBS).\\tThe userspace side\\nof perf creates a guest-only PEBS event, which intel_guest_get_msrs()\\nmisconstrues a guest-*owned* PEBS event.\\n\\nArguably, this is a userspace bug, as enabling PEBS on guest-only events\\nsimply cannot work, and userspace can kill VMs in many other ways (there\\nis no danger to the host).  However, even if this is considered to be bad\\nuserspace behavior, there\u0027s zero downside to perf/KVM restricting PEBS to\\nguest-owned events.\\n\\nNote, commit 854250329c02 (\\\"KVM: x86/pmu: Disable guest PEBS temporarily\\nin two rare situations\\\") fixed the case where host userspace is profiling\\nKVM *and* userspace, but missed the case where userspace is profiling only\\nKVM.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: perf/x86/intel: KVM: Enmascarar PEBS_ENABLE cargado para el invitado con el valor de la vCPU. Al generar el valor MSR_IA32_PEBS_ENABLE que se cargar\u00e1 en VM-Entry a un invitado KVM, enmascarar el valor con el valor PEBS_ENABLE deseado de la vCPU. Consultar \u00fanicamente las m\u00e1scaras de host vs. invitado del kernel del host da como resultado que el invitado se ejecute con PEBS habilitado incluso cuando el invitado no desea usarlo. Debido a que KVM usa eventos perf para proxyizar la PMU virtual del invitado, simplemente mirar exclude_host no puede diferenciar entre eventos creados por el espacio de usuario del host y eventos creados por KVM en nombre del invitado. Ejecutar el invitado con PEBS habilitado inesperadamente generalmente se manifiesta como bloqueos debido a un flujo casi infinito de #PF. Por ejemplo, si el invitado no ha escrito MSR_IA32_DS_AREA, la CPU encontrar\u00e1 fallos de p\u00e1gina en la direcci\u00f3n \u00270\u0027 al intentar registrar eventos PEBS. El problema se reproduce m\u00e1s f\u00e1cilmente ejecutando `perf kvm top` antes de el commit 7b100989b4f6 (\\\"perf evlist: Remove __evlist__add_default\\\") (tras lo cual, `perf kvm top` dej\u00f3 de usar PEBS). El lado del espacio de usuario de perf crea un evento PEBS exclusivo para invitados, que intel_guest_get_msrs() malinterpreta como un evento PEBS *propiedad* del invitado. Podr\u00eda decirse que se trata de un error del espacio de usuario, ya que habilitar PEBS en eventos exclusivos para invitados simplemente no funciona, y el espacio de usuario puede bloquear m\u00e1quinas virtuales de muchas otras maneras (sin peligro para el host). Sin embargo, incluso si esto se considera un comportamiento inadecuado del espacio de usuario, no hay ninguna desventaja en que perf/KVM restrinja PEBS a eventos propios del invitado. Nota: el commit 854250329c02 (\\\"KVM: x86/pmu: Deshabilitar PEBS invitado temporalmente en dos situaciones excepcionales\\\") corrigi\u00f3 el caso en el que el espacio de usuario del host perfila KVM *y* el espacio de usuario, pero no el caso en el que el espacio de usuario perfila solo KVM.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/160153cf9e4aa875ad086cc094ce34aac8e13d63\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/34b6fa11431aef71045ae5a00d90a7d630597eda\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/44ee0afc9d1e7a7c1932698de01362ed80cfc4b5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/58f6217e5d0132a9f14e401e62796916aa055c1b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/86aa62895fc2fb7ab09d7ca40fae8ad09841f66b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.