CVE-2023-30456

A flaw was found in the KVM’s Intel nested virtualization feature (nVMX). The effective values of the guest CR0 and CR4 registers could differ from those included in the VMCS12. In rare circumstances (i.e., kvm_intel module loaded with parameters nested=1 and ept=0) this could allow a malicious guest to crash the host system, causing a denial of service.

Mitigation

This vulnerability can be mitigated by disabling the nested virtualization feature:

# modprobe -r kvm_intel  
# modprobe kvm_intel nested=0