CVE-2021-46977

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-46977
In the Linux kernel, the following vulnerability has been resolved: KVM: VMX: Disable preemption when probing user return MSRs Disable preemption when probing a user return MSR via RDSMR/WRMSR. If the MSR holds a different value per logical CPU, the WRMSR could corrupt the host's value if KVM is preempted between the RDMSR and WRMSR, and then rescheduled on a different CPU. Opportunistically land the helper in common x86, SVM will use the helper in a future commit.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/31f29749ee970c251b3a7e5b914108425940d089 Patch
https://git.kernel.org/stable/c/5104d7ffcf24749939bea7fdb5378d186473f890 Patch
https://git.kernel.org/stable/c/5adcdeb57007ccf8ab7ac20bf787ffb6fafb1a94 Patch
https://git.kernel.org/stable/c/e3ea1895df719c4ef87862501bb10d95f4177bed Patch
https://git.kernel.org/stable/c/31f29749ee970c251b3a7e5b914108425940d089 Patch
https://git.kernel.org/stable/c/5104d7ffcf24749939bea7fdb5378d186473f890 Patch
https://git.kernel.org/stable/c/5adcdeb57007ccf8ab7ac20bf787ffb6fafb1a94 Patch
https://git.kernel.org/stable/c/e3ea1895df719c4ef87862501bb10d95f4177bed Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.13:rc1:*:*:*:*:*:*
History

08 Jan 2025, 17:34

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
References () https://git.kernel.org/stable/c/31f29749ee970c251b3a7e5b914108425940d089 - () https://git.kernel.org/stable/c/31f29749ee970c251b3a7e5b914108425940d089 - Patch
References () https://git.kernel.org/stable/c/5104d7ffcf24749939bea7fdb5378d186473f890 - () https://git.kernel.org/stable/c/5104d7ffcf24749939bea7fdb5378d186473f890 - Patch
References () https://git.kernel.org/stable/c/5adcdeb57007ccf8ab7ac20bf787ffb6fafb1a94 - () https://git.kernel.org/stable/c/5adcdeb57007ccf8ab7ac20bf787ffb6fafb1a94 - Patch
References () https://git.kernel.org/stable/c/e3ea1895df719c4ef87862501bb10d95f4177bed - () https://git.kernel.org/stable/c/e3ea1895df719c4ef87862501bb10d95f4177bed - Patch
CWE NVD-CWE-noinfo
CPE cpe:2.3:o:linux:linux_kernel:5.13:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
First Time Linux
Linux linux Kernel

21 Nov 2024, 06:35

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/31f29749ee970c251b3a7e5b914108425940d089 - () https://git.kernel.org/stable/c/31f29749ee970c251b3a7e5b914108425940d089 -
References () https://git.kernel.org/stable/c/5104d7ffcf24749939bea7fdb5378d186473f890 - () https://git.kernel.org/stable/c/5104d7ffcf24749939bea7fdb5378d186473f890 -
References () https://git.kernel.org/stable/c/5adcdeb57007ccf8ab7ac20bf787ffb6fafb1a94 - () https://git.kernel.org/stable/c/5adcdeb57007ccf8ab7ac20bf787ffb6fafb1a94 -
References () https://git.kernel.org/stable/c/e3ea1895df719c4ef87862501bb10d95f4177bed - () https://git.kernel.org/stable/c/e3ea1895df719c4ef87862501bb10d95f4177bed -
Summary
  • (es) En el kernel de Linux, se resolvió la siguiente vulnerabilidad: KVM: VMX: deshabilite la preferencia al sondear los MSR devueltos por el usuario. Deshabilite la preferencia al sondear el MSR devuelto por un usuario a través de RDSMR/WRMSR. Si MSR tiene un valor diferente por CPU lógica, WRMSR podría dañar el valor del host si KVM se adelanta entre RDMSR y WRMSR y luego se reprograma en una CPU diferente. De manera oportunista, coloque el asistente en x86 común, SVM usará el asistente en una confirmación futura.

28 Feb 2024, 09:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-28 09:15

Updated : 2025-01-08 17:34

NVD link : CVE-2021-46977

Mitre link : CVE-2021-46977

CVE.ORG link : CVE-2021-46977

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
NVD-CWE-noinfo