PT-2021-8001 · Linux · Linux Kernel

Published 2021-04-17 · Updated 2024-12-10 · CVE-2021-47062

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:A/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue is related to a possible null-pointer dereference in the KVM subsystem of the Linux kernel. This occurs when using the created vcpus parameter instead of online vcpus to iterate over vCPUs when encrypting VMSAs for SEV. The created vcpus parameter does not guarantee that a vCPU exists, as it is updated at the beginning of KVM CREATE VCPU. This allows the bulk of vCPU creation to run in parallel while restricting the maximum number of vCPUs. The vulnerability may be exploited by a remote attacker to cause a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BDU:2024-01748

CVE-2021-47062

Affected Products

Linux Kernel

References · 20

• https://git.kernel.org/stable/c/ba7bf5d6336aa9c0d977b161bfa420c56d46ee40 · Patch
• https://osv.dev/vulnerability/CVE-2021-47062 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-47062 · Security Note
• https://git.kernel.org/stable/c/bd0cced2ae93195668f983d443f7f17e8efd24d2 · Patch
• https://bdu.fstec.ru/vul/2024-01748 · Security Note
• https://git.kernel.org/stable/c/c36b16d29f3af5f32fc1b2a3401bf48f71cabee1 · Patch
• https://security-tracker.debian.org/tracker/CVE-2021-47062 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-47062 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-47062 · Security Note
• https://ubuntu.com/security/CVE-2021-47062 · Vendor Advisory
• https://lore.kernel.org/linux-cve-announce/2024022953-CVE-2021-47062-ed39@gregkh/T/#u · Note
• https://access.redhat.com/security/cve/cve-2021-47062 · Note
• https://lore.kernel.org/linux-cve-announce/2024022953-CVE-2021-47062-ed39@gregkh/T · Note
• https://vuldb.com/ru/?id.255349 · Note
• https://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.12.4 · Note