CVE-2024-26992: KVM: x86/pmu: Disable support for adaptive PEBS
In the Linux kernel, the following vulnerability has been resolved:
KVM: x86/pmu: Disable support for adaptive PEBS
Drop support for virtualizing adaptive PEBS, as KVM's implementation is
architecturally broken without an obvious/easy path forward, and because
exposing adaptive PEBS can leak host LBRs to the guest, i.e. can leak
host kernel addresses to the guest.
Bug #1 is that KVM doesn't account for the upper 32 bits of
IA32_FIXED_CTR_CTRL when (re)programming fixed counters, e.g
fixed_ctrl_field() drops the upper bits, reprogram_fixed_counters()
stores local variables as u8s and truncates the upper bits too, etc.
Bug #2 is that, because KVM _always_ sets precise_ip to a non-zero value
for PEBS events, perf will _always_ generate an adaptive record, even if
the guest requested a basic record. Note, KVM will also enable adaptive
PEBS in individual *counter*, even if adaptive PEBS isn't exposed to the
guest, but this is benign as MSR_PEBS_DATA_CFG is guaranteed to be zero,
i.e. the guest will only ever see Basic records.
Bug #3 is in perf. intel_pmu_disable_fixed() doesn't clear the upper
bits either, i.e. leaves ICL_FIXED_0_ADAPTIVE set, and
intel_pmu_enable_fixed() effectively doesn't clear ICL_FIXED_0_ADAPTIVE
either. I.e. perf _always_ enables ADAPTIVE counters, regardless of what
KVM requests.
Bug #4 is that adaptive PEBS *might* effectively bypass event filters set
by the host, as "Updated Memory Access Info Group" records information
that might be disallowed by userspace via KVM_SET_PMU_EVENT_FILTER.
Bug #5 is that KVM doesn't ensure LBR MSRs hold guest values (or at least
zeros) when entering a vCPU with adaptive PEBS, which allows the guest
to read host LBRs, i.e. host RIPs/addresses, by enabling "LBR Entries"
records.
Disable adaptive PEBS support as an immediate fix due to the severity of
the LBR leak in particular, and because fixing all of the bugs will be
non-trivial, e.g. not suitable for backporting to stable kernels.
Note! This will break live migration, but trying to make KVM play nice
with live migration would be quite complicated, wouldn't be guaranteed to
work (i.e. KVM might still kill/confuse the guest), and it's not clear
that there are any publicly available VMMs that support adaptive PEBS,
let alone live migrate VMs that support adaptive PEBS, e.g. QEMU doesn't
support PEBS in any capacity.
Security readout for executives and security teams
Plain-English summary
A virtual machine may obtain host kernel addresses through a flaw in Linux KVM’s virtualization of Intel adaptive PEBS. This crosses the guest-host security boundary and could weaken protections against further host attacks. The supplied CVSS score is 7.3.
Executive priority
Prioritize multi-tenant or untrusted-workload KVM hosts because the issue crosses isolation boundaries and exposes host kernel addresses. Patch promptly through normal kernel maintenance, while testing migration-sensitive environments. Lower priority may be reasonable only after confirming adaptive PEBS cannot reach guests.
Technical view
KVM and perf mishandle adaptive PEBS configuration, record generation, event filtering, and Last Branch Record state. A guest can potentially receive stale host LBR entries containing host instruction addresses. The upstream remediation disables adaptive PEBS virtualization because safely correcting every identified defect was unsuitable for stable backports.
Likely exposure
Exposure concerns Linux KVM hosts running affected kernel branches where Intel adaptive PEBS is available to guests. Exact distribution exposure depends on backports. The source says QEMU does not support PEBS, potentially limiting common deployments, but administrators should verify their actual VMM and kernel configuration.
Exploitation context
The CVSS vector characterizes exploitation as local, low-complexity, requiring low privileges and no user interaction. The primary documented outcome is high-confidentiality host address leakage, with possible low-integrity impact. This CVE is not identified as KEV, and the supplied sources do not report active exploitation.
Researcher notes
The disclosure identifies five related defects rather than one isolated coding error. The most serious is failure to sanitize LBR state before vCPU entry. Event-filter bypass is described as possible, not confirmed. Public sources supplied here do not establish a working exploit, exploitation in the wild, or applicability to every KVM configuration.
Mitigation direction
Install a vendor-supported kernel containing the applicable linked stable fix.
Follow the Linux distribution’s advisory to determine the corrected package for each kernel branch.
If upgrades are delayed, obtain vendor guidance for preventing adaptive PEBS exposure to guests.
Stage remediation where migration compatibility or performance-monitoring features are operationally important.
Validation and detection
Inventory KVM hosts, running kernel versions, CPU models, VMMs, and guest-visible PMU capabilities.
Confirm each deployed kernel package incorporates the applicable upstream stable fix or distribution backport.
Verify adaptive PEBS is no longer exposed to guests after remediation.
Test live migration and monitoring workloads because disabling adaptive PEBS may affect compatibility.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2024-26992 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.