CVE-2022-3344: Linux Kernel AMD KVM DoS Vulnerability

CVE-2022-3344 Overview

A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) implementation for AMD nested virtualization using SVM (Secure Virtual Machine). A malicious L1 guest could purposely fail to intercept the shutdown of a cooperative nested guest (L2), potentially leading to a page fault and kernel panic in the host (L0). This vulnerability represents a significant denial of service risk in virtualized environments utilizing AMD processors with nested virtualization capabilities.

Critical Impact

A malicious guest VM can cause a kernel panic in the host system, leading to complete denial of service for all virtual machines and services running on the affected host.

Affected Products

• Linux Linux Kernel (all affected versions with KVM AMD SVM nested virtualization)

Discovery Timeline

• 2022-10-25 - CVE CVE-2022-3344 published to NVD
• 2025-05-07 - Last updated in NVD database

Technical Details for CVE-2022-3344

Vulnerability Analysis

The vulnerability exists within the KVM hypervisor's handling of AMD SVM nested virtualization. In a nested virtualization scenario, there are typically three levels: the physical host (L0), the primary guest hypervisor (L1), and the nested guest (L2). The flaw occurs when the L1 guest intentionally fails to properly intercept and handle the shutdown event of a cooperative L2 nested guest.

When this shutdown interception failure occurs, the KVM subsystem in the host kernel encounters an unexpected state that can trigger a page fault. Because this occurs in kernel context during hypervisor operations, the page fault condition leads to a kernel panic, causing the entire host system to crash.

The vulnerability is classified under CWE-440 (Expected Behavior Violation), indicating that the KVM implementation does not properly handle the unexpected behavior from the L1 guest when it fails to intercept the L2 shutdown as expected. The attack requires local access and low privileges, with no user interaction needed to exploit.

Root Cause

The root cause lies in the KVM AMD SVM code path that handles nested guest shutdown events. The implementation assumes that the L1 hypervisor will properly intercept and handle all L2 shutdown events. When the L1 guest deliberately fails to perform this interception, the host's KVM code encounters an unhandled condition that results in accessing invalid memory, triggering a page fault in kernel mode.

The expected behavior violation occurs because the KVM nested virtualization code does not implement adequate defensive checks to handle malicious or misbehaving L1 guests that do not follow the expected nested virtualization protocol.

Attack Vector

The attack vector is local, requiring an attacker to have access to a guest virtual machine running on the target host. The attacker must be able to run a nested hypervisor (L1 guest) that can create and control nested guests (L2). By crafting a malicious L1 hypervisor that intentionally mishandles L2 shutdown events, the attacker can trigger the vulnerability.

The attack scenario involves:

1. Attacker gains access to an L1 guest VM with nested virtualization enabled
2. Attacker launches a cooperative L2 nested guest
3. When the L2 guest initiates shutdown, the malicious L1 hypervisor intentionally fails to intercept the event
4. The host KVM code encounters the unhandled state, leading to a page fault
5. The kernel panic crashes the entire host system, affecting all other VMs

For detailed technical information about the vulnerability mechanism and the proposed fix, see the Linux Kernel Patch Proposal.

Detection Methods for CVE-2022-3344

Indicators of Compromise

• Unexpected host system kernel panics with page fault errors in KVM-related code paths
• Crash dumps showing faults originating from kvm_svm or nested virtualization functions
• System logs indicating unexpected L2 guest shutdown handling failures
• Repeated host crashes correlating with nested virtualization activity

Detection Strategies

• Monitor kernel logs for KVM-related page faults and exceptions, particularly those involving SVM nested virtualization code paths
• Implement kernel crash analysis to identify patterns consistent with this vulnerability
• Deploy host-based intrusion detection to identify suspicious behavior from L1 guests attempting to manipulate L2 shutdown sequences
• Review audit logs for nested virtualization configuration changes or unusual VM lifecycle events

Monitoring Recommendations

• Enable comprehensive kernel logging for KVM and SVM subsystems
• Configure crash dump collection and analysis for rapid incident investigation
• Monitor system stability metrics across virtualization hosts using AMD processors
• Implement alerting for any unexpected host reboots or kernel panics in virtualized environments

How to Mitigate CVE-2022-3344

Immediate Actions Required

• Update the Linux kernel to a patched version that addresses this vulnerability
• Consider disabling nested virtualization on AMD systems if not strictly required until patches can be applied
• Restrict access to L1 guest VMs to trusted administrators only
• Review and audit which guests have nested virtualization capabilities enabled

Patch Information

Security patches have been proposed and are tracked through the Linux kernel mailing list. Organizations should apply the latest stable kernel version that incorporates the fix for this vulnerability. For Red Hat-based distributions, refer to the Red Hat Bug Report #2130278 for distribution-specific patch information.

System administrators should prioritize updating affected systems, particularly those running production workloads with nested virtualization enabled.

Workarounds

• Disable AMD SVM nested virtualization by removing or not loading the npt module option or setting nested=0 in KVM module parameters
• Restrict nested virtualization capabilities to only essential workloads with trusted administrators
• Implement strict access controls to limit who can create and manage L1 guest virtual machines
• Consider migrating critical workloads to hosts not using nested virtualization until patching is complete

# Configuration example - Disable nested virtualization for KVM AMD
# Add to /etc/modprobe.d/kvm.conf
options kvm_amd nested=0

# Reload the KVM module (requires VM shutdown)
modprobe -r kvm_amd
modprobe kvm_amd