Loading vulnerability…
Linux Kernel KVM s390 FPC Register Corruption
CVE-2023-52597 is an improper input-validation flaw in Linux kernel KVM support for IBM s390 systems. The KVM vCPU FPU-state ioctl temporarily loaded a guest-supplied floating-point control (FPC) value into the host CPU FPC register to validate it. If an interrupt occurred during that interval and interrupt-context code used floating-point or vector registers, the kernel could save the temporary guest FPC state as though it belonged to the host userspace process. Although the validation routine restored the original FPC value, that restoration could be discarded on return to userspace, causing the host process to continue with the guest-provided FPC value. The fix removes the unsafe temporary validation; invalid FPC values are handled before entry into the SIE execution context.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A successful trigger corrupts the floating-point control state of the host process operating KVM. The affected process may resume with guest-selected FPC semantics, potentially causing incorrect floating-point behavior, low integrity impact, or process instability and denial of service. Available CVSS v3.1 scoring assigns low integrity and availability impact and no confidentiality impact.
If you can’t patch tonight, do this now.
Until an updated kernel can be deployed, restrict access to KVM device interfaces and prevent untrusted local workloads from creating or controlling s390 KVM virtual machines. Limit use of the affected vCPU FPU-state ioctl through virtualization-management access controls. Reboot after applying the kernel update.
Patch, then assume compromise.
Install a Linux kernel update containing the KVM s390 FPC handling fix, then reboot so the updated kernel is running. Fixed Red Hat packages were released for RHEL 8 kernel, RHEL 8 kernel-rt, and RHEL 9 kernel. The fix removes temporary loading of the untrusted FPC value during ioctl validation.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.