PT-2024-11238 · Linux+2 · Linux Kernel+2

Published 2021-06-10 · Updated 2024-07-03 · CVE-2021-47230

Positive Technologies (AI Summary)

CVSS v3.1

6.6

Medium

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.13.0-rc5-syzkaller

Description The vulnerability is related to the KVM (Kernel-based Virtual Machine) component of the Linux kernel. It occurs when the MMU (Memory Management Unit) context is not properly reset after the SMM (System Management Mode) flag is cleared. This can lead to a NULL pointer dereference when handling a page fault, resulting in a general protection fault. The issue arises because the SMM flag in the MMU role is not synchronized with the vCPU's flag, causing the MMU to be in a bad state. This can happen when RSM (Resume from SMM) fails and is not correctly emulated, leading to the MMU not being properly reset.

Recommendations To resolve this issue, update the Linux kernel to a version that includes the fix for this vulnerability. Specifically, versions prior to 5.13.0-rc5-syzkaller are affected, so updating to 5.13.0-rc5-syzkaller or later should resolve the issue.

As a temporary workaround, consider disabling the KVM component until a patch is available. However, this may not be feasible in all environments, especially those relying heavily on virtualization.

It is also recommended to monitor system logs for any signs of the general protection fault and to implement additional security measures to detect and prevent potential exploitation of this vulnerability.

Note: The provided information does not specify the exact version in which the vulnerability was fixed, only that versions prior to 5.13.0-rc5-syzkaller are affected. Therefore, the recommendation is to update to the latest available kernel version to ensure the inclusion of the fix.

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BDU:2025-07344

CVE-2021-47230

OPENSUSE-SU-2024_2185-1

SUSE-SU-2024:2010-1

SUSE-SU-2024:2185-1

Affected Products

Astra Linux

Linux Kernel

Suse

References · 424

• https://ubuntu.com/security/CVE-2021-47230 · Vendor Advisory
• https://git.kernel.org/stable/c/78fcb2c91adfec8ce3a2ba6b4d0dda89f2f4a7c6 · Patch
• https://git.kernel.org/stable/c/cbb425f62df9df7abee4b3f068f7ed6ffc3561e2 · Patch
• https://git.kernel.org/stable/c/669a8866e468fd020d34eb00e08cb41d3774b71b · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-47230 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:2185-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-07344 · Security Note
• https://git.kernel.org/stable/c/df9a40cfb3be2cbeb1c17bb67c59251ba16630f3 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2024:2010-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-47230 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-47230 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-47230 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-47230 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-47230 · Vendor Advisory
• https://suse.com/security/cve/CVE-2021-47329 · Note