Linux KVM s390 FPU Validation Flaw Can Corrupt Host Process State
Vulnerability Disclosure · 2 sources · Updated 2mo ago · First seen May 22, 2024
CVE-2023-52597 is a low-severity flaw in the Linux kernel's KVM implementation for IBM s390 systems. When KVM uses an ioctl to set a guest vCPU floating-point-unit state, it temporarily loads a floating-point control (FPC) value while validating it; an interrupt that uses floating-point or vector registers during that window can corrupt the host process's FPC register. Red Hat rates the issue CVSS 4.0 (AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L) and classifies it as improper input validation (CWE-20).
Red Hat issued fixes for RHEL 8 kernel and kernel-rt packages and RHEL 9 kernel packages. RHEL 9 kernel-rt remained affected at the time of the advisory, while RHEL 6 and RHEL 7 kernel variants were outside support scope. Organizations operating KVM workloads on IBM s390 should identify affected kernel packages and apply the available updates, prioritizing systems where untrusted or highly privileged guest-management operations are permitted.
