linux-cve-announce - CVE-2021-47008: KVM: SVM: Make sure GHCB is mapped before updating

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2024022830-CVE-2021-47008-3dc3@gregkh>
Date: Wed, 28 Feb 2024 09:14:58 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: gregkh@...nel.org
Subject: CVE-2021-47008: KVM: SVM: Make sure GHCB is mapped before updating

From: gregkh@...nel.org

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

KVM: SVM: Make sure GHCB is mapped before updating

Access to the GHCB is mainly in the VMGEXIT path and it is known that the
GHCB will be mapped. But there are two paths where it is possible the GHCB
might not be mapped.

The sev_vcpu_deliver_sipi_vector() routine will update the GHCB to inform
the caller of the AP Reset Hold NAE event that a SIPI has been delivered.
However, if a SIPI is performed without a corresponding AP Reset Hold,
then the GHCB might not be mapped (depending on the previous VMEXIT),
which will result in a NULL pointer dereference.

The svm_complete_emulated_msr() routine will update the GHCB to inform
the caller of a RDMSR/WRMSR operation about any errors. While it is likely
that the GHCB will be mapped in this situation, add a safe guard
in this path to be certain a NULL pointer dereference is not encountered.

The Linux kernel CVE team has assigned CVE-2021-47008 to this issue.

Affected and fixed versions
===========================

	Issue introduced in 5.11 with commit 647daca25d24 and fixed in 5.11.22 with commit fb9e14f4f821
	Issue introduced in 5.11 with commit 647daca25d24 and fixed in 5.12.5 with commit fd722a57fe0b
	Issue introduced in 5.11 with commit 647daca25d24 and fixed in 5.13 with commit a3ba26ecfb56

Please see https://www.kernel.org or a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2021-47008
will be updated if fixes are backported, please check that for the most
up to date information about this issue.

Affected files
==============

The file(s) affected by this issue are:
	arch/x86/kvm/svm/sev.c
	arch/x86/kvm/svm/svm.c

Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/fb9e14f4f8217a0980f8da2c8ff70dee058cbe47
	https://git.kernel.org/stable/c/fd722a57fe0b80133dacae4e1c852ee4212f9b2e
	https://git.kernel.org/stable/c/a3ba26ecfb569f4aa3f867e80c02aa65f20aadad