Uninitialized Variable Vulnerability in Linux Kernel's KVM Hypervisor

CVE-2023-53756

What is CVE-2023-53756?

A vulnerability exists in the Linux kernel's KVM module where an uninitialized variable leads to a NULL pointer dereference. When enabling 'Enlightened VMCS' and 'Enlightened MSR Bitmap', an uninitialized per-CPU variable 'current_vmcs' can erroneously cause crashes by allowing incorrect access to its structure. Specifically, this flaw arises during the manipulation of MSR bitmaps in nested hypervisors. This situation can give rise to instability and unexpected behavior in virtual machines running on systems using KVM.

References