| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <2024022830-CVE-2021-47008-3dc3@gregkh> Date: Wed, 28 Feb 2024 09:14:58 +0100 From: Greg Kroah-Hartman <gregkh@...uxfoundation.org> To: linux-cve-announce@...r.kernel.org Cc: gregkh@...nel.org Subject: CVE-2021-47008: KVM: SVM: Make sure GHCB is mapped before updating From: gregkh@...nel.org Description =========== In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Make sure GHCB is mapped before updating Access to the GHCB is mainly in the VMGEXIT path and it is known that the GHCB will be mapped. But there are two paths where it is possible the GHCB might not be mapped. The sev_vcpu_deliver_sipi_vector() routine will update the GHCB to inform the caller of the AP Reset Hold NAE event that a SIPI has been delivered. However, if a SIPI is performed without a corresponding AP Reset Hold, then the GHCB might not be mapped (depending on the previous VMEXIT), which will result in a NULL pointer dereference. The svm_complete_emulated_msr() routine will update the GHCB to inform the caller of a RDMSR/WRMSR operation about any errors. While it is likely that the GHCB will be mapped in this situation, add a safe guard in this path to be certain a NULL pointer dereference is not encountered. The Linux kernel CVE team has assigned CVE-2021-47008 to this issue. Affected and fixed versions =========================== Issue introduced in 5.11 with commit 647daca25d24 and fixed in 5.11.22 with commit fb9e14f4f821 Issue introduced in 5.11 with commit 647daca25d24 and fixed in 5.12.5 with commit fd722a57fe0b Issue introduced in 5.11 with commit 647daca25d24 and fixed in 5.13 with commit a3ba26ecfb56 Please see https://www.kernel.org or a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2021-47008 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: arch/x86/kvm/svm/sev.c arch/x86/kvm/svm/svm.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/fb9e14f4f8217a0980f8da2c8ff70dee058cbe47 https://git.kernel.org/stable/c/fd722a57fe0b80133dacae4e1c852ee4212f9b2e https://git.kernel.org/stable/c/a3ba26ecfb569f4aa3f867e80c02aa65f20aadad
Powered by blists - more mailing lists