PT-2021-4275 · Linux+5 · Linux Kernel+5
Felix Wilhelm
·
Published
2021-04-01
·
Updated
2023-05-19
·
CVE-2021-29657
CVSS v3.1
7.4
High
| Vector | AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 5.11.12
Description
The issue is related to a use-after-free vulnerability in the arch/x86/kvm/svm/nested.c component of the Linux kernel, specifically affecting AMD KVM guests. This vulnerability can be exploited to bypass access control on host OS MSRs when there are nested guests, due to a TOCTOU race condition associated with a VMCB12 double fetch in nested svm vmrun. The vulnerability allows an attacker to execute code outside of the guest system, potentially leading to privilege escalation.
Recommendations
For Linux kernel versions prior to 5.11.12, update to version 5.11.12 or later to resolve the issue. As a temporary workaround, consider disabling the nested guest feature in AMD KVM until a patch is available. Restrict access to the vulnerable
arch/x86/kvm/svm/nested.c component to minimize the risk of exploitation. Avoid using the nested svm vmrun function until the issue is resolved.Exploit
Fix
Time Of Check To Time Of Use
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Centos
Linuxmint
Linux Kernel
Red Hat
Ubuntu