Linux 7.4 adds Intel Instruction Timeout to prevent TDX VM DoS attacks
1 min read
•
Impact: 6/10
Key Takeaway
Linux 7.4 will include new KVM TDX features to mitigate denial of service attacks from malicious guest virtual machines.
Summary
The Linux 7.4 kernel is introducing support for Intel's Instruction Timeout feature (formerly Notify VM Exit) within the KVM TDX code. This security mechanism aims to prevent rogue guest VMs from causing denial of service attacks by blocking interrupt handling or locking CPU cores. Additionally, the update adds Bus Lock VM Exit support to force VM exits when guest CPUs execute bus lock instructions.
KVM TDX security enhancements
- Intel Instruction Timeout (Notify VM Exit) prevents malicious guest VMs from starving host resources by blocking event handling.
- Bus Lock VM Exit support forces a VM to exit to user-space when a guest CPU executes a bus lock instruction.
- These changes are part of the KVM+TDX pull request targeting the Linux 7.4 release.
Why it matters
These mitigations improve the security and stability of cloud environments using Intel Trust Domain Extensions (TDX) by protecting the host from malicious guest workloads.