CyberRota Analysis
AI-GeneratedThe vulnerability affects the Linux kernel's KVM (Kernel-based Virtual Machine) component, specifically in the handling of the CPUID entry count during virtual machine initialization. If userspace modifies the cpuid.nent value concurrently, it could lead to out-of-bounds memory access, potentially allowing unauthorized access to sensitive data or system instability. Organizations utilizing Linux-based systems with KVM should prioritize this issue to mitigate risks associated with virtual machine security and data integrity.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: KVM: TDX: Reject concurrent change to CPUID entry count Reject KVM_TDX_INIT_VM if userspace changes cpuid.nent between the initial read and the subsequent copy of the initialization data. tdx_td_init() first reads user_data->cpuid.nent to size the flexible kvm_tdx_init_vm copy. The copied structure also contains cpuid.nent, and that field can differ from the value used to size the allocation if userspace modifies the input concurrently. setup_tdparams_cpuids() later passes init_vm->cpuid.nent to kvm_find_cpuid_entry2(), which uses it as the array bound for the copied entries. Require the copied count to match the value used to size the allocation so that CPUID parsing cannot access beyond the entries actually copied.