kvm nSVM VMCB Corruption

Vulnerability analysis

The vulnerability stems from inconsistent VMCB (Virtual Machine Control Block) usage in KVM's nested SVM implementation. While commit cc3ed80ae69f standardized KVM to always use vmcb01 for VMSAVE/VMLOAD operations, the emulation code for these instructions was not updated accordingly. When an L2 guest executes VMLOAD/VMSAVE and L1 doesn't intercept it, KVM mistakenly operates on vmcb02 instead of vmcb01. For VMSAVE, this copies stale or uninitialized vmcb02 fields into L1-accessible guest memory (vmcb12), creating an information-leak primitive. For VMLOAD, this writes attacker-controlled values from vmcb12 into the hypervisor's vmcb02, corrupting hypervisor-managed guest state. The fix ensures both the actual hardware operations and emulation code consistently use vmcb01, preventing information disclosure and state corruption in nested virtualization scenarios.