CVE-2024-45005
📋 TL;DR
A vulnerability in the Linux kernel's KVM subsystem for s390 architecture allows a guest VM to trigger a host kernel warning when GISA (Guest Information Save Area) is disabled. This occurs due to an uninitialized value being passed to virt_to_phys() when GISA is turned off via kernel parameter or sysfs. The issue affects Linux systems running KVM virtualization on IBM s390 architecture.
💻 Affected Systems
- Linux kernel
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Host kernel warning/panic leading to denial of service for KVM guests, potentially disrupting virtualization services.
Likely Case
KVM guest startup failures with kernel warnings in host logs, causing guest unavailability.
If Mitigated
No impact if GISA is enabled (default) or KVM is not used on s390 systems.
🎯 Exploit Status
Exploitation requires local access to start KVM guests. No remote exploitation vector identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Linux kernel stable releases containing fixes from the referenced commits
Vendor Advisory: https://git.kernel.org/stable/c/027ac3c5092561bccce09b314a73a1c167117ef6
Restart Required: Yes
Instructions:
1. Update Linux kernel to version containing the fix. 2. Reboot system. 3. Verify kernel version and that GISA functionality works correctly.
🔧 Temporary Workarounds
Enable GISA
linuxEnsure GISA is enabled by removing 'kvm.use_gisa=0' from kernel parameters and setting sysfs attribute to Y
echo Y > /sys/module/kvm/parameters/use_gisa
Remove 'kvm.use_gisa=0' from kernel boot parameters in /etc/default/grub or bootloader config
🧯 If You Can't Patch
- Keep GISA enabled (default setting) by not using 'kvm.use_gisa=0' parameter
- Monitor host kernel logs for 'unhandled validity intercept' warnings and investigate any KVM guest startup failures
🔍 How to Verify
Check if Vulnerable:
Check if GISA is disabled: cat /sys/module/kvm/parameters/use_gisa. If 'N' and running vulnerable kernel version, system is vulnerable.Check Version:
uname -rVerify Fix Applied:
After patching, verify kernel version is updated and test starting KVM guests with GISA disabled should not produce kernel warnings.📡 Detection & Monitoring
Log Indicators:
- kernel: kvm: unhandled validity intercept 0x1011
- kernel: WARNING: CPU: 0 PID: at arch/s390/kvm/intercept.c:101 kvm_handle_sie_intercept
SIEM Query:
source="kernel" AND "unhandled validity intercept" AND "kvm_handle_sie_intercept"