Detections
Analytics

Google: sys-kernel/lakitu-kernel-6_1: security update to 17935.0.0

medium Tenable Self-Hosted Container Security Plugin ID 451489

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Load L1's TSC multiplier
 based on L1 state, not L2 state When emulating nested VM-Exit, load L1's TSC multiplier if L1's desired
 ratio doesn't match the current ratio, not if the ratio L1 is using for L2 diverges from the default.
 Functionally, the end result is the same as KVM will run L2 with L1's multiplier if L2's multiplier is the
 default, i.e. checking that L1's multiplier is loaded is equivalent to checking if L2 has a non-default
 multiplier. However, the assertion that TSC scaling is exposed to L1 is flawed, as userspace can trigger
 the WARN at will by writing the MSR and then updating guest CPUID to hide the feature (modifying guest
 CPUID is allowed anytime before KVM_RUN). E.g. hacking KVM's state_test selftest to do vcpu_set_msr(vcpu,
 MSR_AMD64_TSC_RATIO, 0); vcpu_clear_cpuid_feature(vcpu, X86_FEATURE_TSCRATEMSR); after restoring state in
 a new VM+vCPU yields an endless supply of: ------------[ cut here ]------------ WARNING: CPU: 10 PID:
 206939 at arch/x86/kvm/svm/nested.c:1105 nested_svm_vmexit+0x6af/0x720 [kvm_amd] Call Trace:
 nested_svm_exit_handled+0x102/0x1f0 [kvm_amd] svm_handle_exit+0xb9/0x180 [kvm_amd]
 kvm_arch_vcpu_ioctl_run+0x1eab/0x2570 [kvm] kvm_vcpu_ioctl+0x4c9/0x5b0 [kvm] ?
 trace_hardirqs_off+0x4d/0xa0 __se_sys_ioctl+0x7a/0xc0 __x64_sys_ioctl+0x21/0x30 do_syscall_64+0x41/0x90
 entry_SYSCALL_64_after_hwframe+0x63/0xcd Unlike the nested VMRUN path, hoisting the
 svm->tsc_scaling_enabled check into the if-statement is wrong as KVM needs to ensure L1's multiplier is
 loaded in the above scenario. Alternatively, the WARN_ON() could simply be deleted, but that would make
 KVM's behavior even more subtle, e.g. it's not immediately obvious why it's safe to write
 MSR_AMD64_TSC_RATIO when checking only tsc_ratio_msr. (CVE-2023-53208)

Solution

Update the sys-kernel/lakitu-kernel-6_1 library and its related packages to version 17935.0.0 or later.

See Also

https://storage.googleapis.com/cos-oval-vulnerability-feed/cos-113.oval.xml.tar.gz

Plugin Details

Severity: Medium

ID: 451489

Version: Revision 1.1

Type: Local

Published: 10/1/2026

Updated: 10/1/2026

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 93.48

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2023-53208

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 10/3/2023

Reference Information

CVE: CVE-2023-53208