CVE-2021-47061 - OpenCVE

In the Linux kernel, the following vulnerability has been resolved: KVM: Destroy I/O bus devices on unregister failure _after_ sync'ing SRCU If allocating a new instance of an I/O bus fails when unregistering a device, wait to destroy the device until after all readers are guaranteed to see the new null bus. Destroying devices before the bus is nullified could lead to use-after-free since readers expect the devices on their reference of the bus to remain valid.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://git.kernel.org/stable/c/03c6cccedd3913006744faa252a4da5145299343
https://git.kernel.org/stable/c/2ee3757424be7c1cd1d0bbfa6db29a7edd82a250
https://git.kernel.org/stable/c/30f46c6993731efb2a690c9197c0fd9ed425da2d
https://git.kernel.org/stable/c/4e899ca848636b37e9ac124bc1723862a7d7d927
https://lore.kernel.org/linux-cve-announce/2024022952-CVE-2021-47061-6fea@gregkh/T/#u
https://nvd.nist.gov/vuln/detail/CVE-2021-47061
https://www.cve.org/CVERecord?id=CVE-2021-47061

History

Mon, 04 Nov 2024 13:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-02-29T22:37:35.689Z

Updated: 2024-11-04T11:58:40.742Z

Reserved: 2024-02-29T22:33:44.294Z

Link: CVE-2021-47061

Vulnrichment

Updated: 2024-08-04T05:24:39.011Z

NVD

Status : Awaiting Analysis

Published: 2024-02-29T23:15:07.793

Modified: 2024-03-01T14:04:26.010

Link: CVE-2021-47061

Redhat

Severity : Moderate

Publid Date: 2024-02-29T00:00:00Z

Links: CVE-2021-47061 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2021-47061", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-29T22:33:44.294Z", "datePublished": "2024-02-29T22:37:35.689Z", "dateUpdated": "2024-11-04T11:58:40.742Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-11-04T11:58:40.742Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: Destroy I/O bus devices on unregister failure _after_ sync'ing SRCU\n\nIf allocating a new instance of an I/O bus fails when unregistering a\ndevice, wait to destroy the device until after all readers are guaranteed\nto see the new null bus. Destroying devices before the bus is nullified\ncould lead to use-after-free since readers expect the devices on their\nreference of the bus to remain valid."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["virt/kvm/kvm_main.c"], "versions": [{"version": "f65886606c2d", "lessThan": "03c6cccedd39", "status": "affected", "versionType": "git"}, {"version": "f65886606c2d", "lessThan": "4e899ca84863", "status": "affected", "versionType": "git"}, {"version": "f65886606c2d", "lessThan": "30f46c699373", "status": "affected", "versionType": "git"}, {"version": "f65886606c2d", "lessThan": "2ee3757424be", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["virt/kvm/kvm_main.c"], "versions": [{"version": "5.9", "status": "affected"}, {"version": "0", "lessThan": "5.9", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.37", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.11.21", "lessThanOrEqual": "5.11.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.12.4", "lessThanOrEqual": "5.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.13", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "references": [{"url": "https://git.kernel.org/stable/c/03c6cccedd3913006744faa252a4da5145299343"}, {"url": "https://git.kernel.org/stable/c/4e899ca848636b37e9ac124bc1723862a7d7d927"}, {"url": "https://git.kernel.org/stable/c/30f46c6993731efb2a690c9197c0fd9ed425da2d"}, {"url": "https://git.kernel.org/stable/c/2ee3757424be7c1cd1d0bbfa6db29a7edd82a250"}], "title": "KVM: Destroy I/O bus devices on unregister failure _after_ sync'ing SRCU", "x_generator": {"engine": "bippy-9e1c9544281a"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:24:39.011Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/03c6cccedd3913006744faa252a4da5145299343", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/4e899ca848636b37e9ac124bc1723862a7d7d927", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/30f46c6993731efb2a690c9197c0fd9ed425da2d", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/2ee3757424be7c1cd1d0bbfa6db29a7edd82a250", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-08-08T18:46:02.297393Z", "id": "CVE-2021-47061", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-08T18:46:13.135Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/03c6cccedd3913006744faa252a4da5145299343", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/4e899ca848636b37e9ac124bc1723862a7d7d927", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/30f46c6993731efb2a690c9197c0fd9ed425da2d", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/2ee3757424be7c1cd1d0bbfa6db29a7edd82a250", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:24:39.011Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-47061", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-08-08T18:46:02.297393Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-08T18:46:08.349Z"}}], "cna": {"title": "KVM: Destroy I/O bus devices on unregister failure _after_ sync'ing SRCU", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "f65886606c2d", "lessThan": "03c6cccedd39", "versionType": "git"}, {"status": "affected", "version": "f65886606c2d", "lessThan": "4e899ca84863", "versionType": "git"}, {"status": "affected", "version": "f65886606c2d", "lessThan": "30f46c699373", "versionType": "git"}, {"status": "affected", "version": "f65886606c2d", "lessThan": "2ee3757424be", "versionType": "git"}], "programFiles": ["virt/kvm/kvm_main.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.9"}, {"status": "unaffected", "version": "0", "lessThan": "5.9", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.37", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.11.21", "versionType": "semver", "lessThanOrEqual": "5.11.*"}, {"status": "unaffected", "version": "5.12.4", "versionType": "semver", "lessThanOrEqual": "5.12.*"}, {"status": "unaffected", "version": "5.13", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["virt/kvm/kvm_main.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/03c6cccedd3913006744faa252a4da5145299343"}, {"url": "https://git.kernel.org/stable/c/4e899ca848636b37e9ac124bc1723862a7d7d927"}, {"url": "https://git.kernel.org/stable/c/30f46c6993731efb2a690c9197c0fd9ed425da2d"}, {"url": "https://git.kernel.org/stable/c/2ee3757424be7c1cd1d0bbfa6db29a7edd82a250"}], "x_generator": {"engine": "bippy-9e1c9544281a"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: Destroy I/O bus devices on unregister failure _after_ sync'ing SRCU\n\nIf allocating a new instance of an I/O bus fails when unregistering a\ndevice, wait to destroy the device until after all readers are guaranteed\nto see the new null bus. Destroying devices before the bus is nullified\ncould lead to use-after-free since readers expect the devices on their\nreference of the bus to remain valid."}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-11-04T11:58:40.742Z"}}}, "cveMetadata": {"cveId": "CVE-2021-47061", "state": "PUBLISHED", "dateUpdated": "2024-11-04T11:58:40.742Z", "dateReserved": "2024-02-29T22:33:44.294Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-02-29T22:37:35.689Z", "assignerShortName": "Linux"}, "dataVersion": "5.1"}

{"bugzilla": {"description": "kernel: KVM: use-after-free while destroy I/O bus devices on unregister failure", "id": "2267173", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2267173"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.7", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-416", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nKVM: Destroy I/O bus devices on unregister failure _after_ sync'ing SRCU\nIf allocating a new instance of an I/O bus fails when unregistering a\ndevice, wait to destroy the device until after all readers are guaranteed\nto see the new null bus. Destroying devices before the bus is nullified\ncould lead to use-after-free since readers expect the devices on their\nreference of the bus to remain valid.", "A flaw was found in the Linux kernel\u2019s Kernel-based virtual machine (KVM) subsystem. A bug in the code destroys devices attached to I/O buses before the bus can be nullified. This issue causes use-after-free scenarios as readers may still reference the devices on their bus version."], "name": "CVE-2021-47061", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-02-29T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2021-47061\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-47061\nhttps://lore.kernel.org/linux-cve-announce/2024022952-CVE-2021-47061-6fea@gregkh/T/#u"], "statement": "Red Hat Enterprise Linux 8 and 9 are not affected by this vulnerability.", "threat_severity": "Moderate", "upstream_fix": "kernel 5.10.37, kernel 5.11.21, kernel 5.12.4, kernel 5.13"}