CVE-2021-47110 - OpenCVE

In the Linux kernel, the following vulnerability has been resolved: x86/kvm: Disable kvmclock on all CPUs on shutdown Currenly, we disable kvmclock from machine_shutdown() hook and this only happens for boot CPU. We need to disable it for all CPUs to guard against memory corruption e.g. on restore from hibernate. Note, writing '0' to kvmclock MSR doesn't clear memory location, it just prevents hypervisor from updating the location so for the short while after write and while CPU is still alive, the clock remains usable and correct so we don't need to switch to some other clocksource.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://git.kernel.org/stable/c/1df2dc09926f61319116c80ee85701df33577d70
https://git.kernel.org/stable/c/3b0becf8b1ecf642a9edaf4c9628ffc641e490d6
https://git.kernel.org/stable/c/9084fe1b3572664ad276f427dce575f580c9799a
https://git.kernel.org/stable/c/c02027b5742b5aa804ef08a4a9db433295533046
https://lore.kernel.org/linux-cve-announce/2024031506-CVE-2021-47110-2cb8@gregkh/T/#u
https://nvd.nist.gov/vuln/detail/CVE-2021-47110
https://www.cve.org/CVERecord?id=CVE-2021-47110

History

Mon, 04 Nov 2024 13:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-03-15T20:14:19.183Z

Updated: 2024-11-04T11:59:36.144Z

Reserved: 2024-03-04T18:12:48.836Z

Link: CVE-2021-47110

Vulnrichment

Updated: 2024-08-04T05:24:39.913Z

NVD

Status : Awaiting Analysis

Published: 2024-03-15T21:15:06.530

Modified: 2024-03-17T22:38:29.433

Link: CVE-2021-47110

Redhat

Severity : Low

Publid Date: 2024-03-15T00:00:00Z

Links: CVE-2021-47110 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2021-47110", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-03-04T18:12:48.836Z", "datePublished": "2024-03-15T20:14:19.183Z", "dateUpdated": "2024-11-04T11:59:36.144Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-11-04T11:59:36.144Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/kvm: Disable kvmclock on all CPUs on shutdown\n\nCurrenly, we disable kvmclock from machine_shutdown() hook and this\nonly happens for boot CPU. We need to disable it for all CPUs to\nguard against memory corruption e.g. on restore from hibernate.\n\nNote, writing '0' to kvmclock MSR doesn't clear memory location, it\njust prevents hypervisor from updating the location so for the short\nwhile after write and while CPU is still alive, the clock remains usable\nand correct so we don't need to switch to some other clocksource."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/x86/include/asm/kvm_para.h", "arch/x86/kernel/kvm.c", "arch/x86/kernel/kvmclock.c"], "versions": [{"version": "1da177e4c3f4", "lessThan": "9084fe1b3572", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f4", "lessThan": "3b0becf8b1ec", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f4", "lessThan": "1df2dc09926f", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f4", "lessThan": "c02027b5742b", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/x86/include/asm/kvm_para.h", "arch/x86/kernel/kvm.c", "arch/x86/kernel/kvmclock.c"], "versions": [{"version": "5.4.125", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.43", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.12.10", "lessThanOrEqual": "5.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.13", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "references": [{"url": "https://git.kernel.org/stable/c/9084fe1b3572664ad276f427dce575f580c9799a"}, {"url": "https://git.kernel.org/stable/c/3b0becf8b1ecf642a9edaf4c9628ffc641e490d6"}, {"url": "https://git.kernel.org/stable/c/1df2dc09926f61319116c80ee85701df33577d70"}, {"url": "https://git.kernel.org/stable/c/c02027b5742b5aa804ef08a4a9db433295533046"}], "title": "x86/kvm: Disable kvmclock on all CPUs on shutdown", "x_generator": {"engine": "bippy-9e1c9544281a"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-47110", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-03-18T16:10:03.353776Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:13:56.037Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:24:39.913Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/9084fe1b3572664ad276f427dce575f580c9799a", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/3b0becf8b1ecf642a9edaf4c9628ffc641e490d6", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/1df2dc09926f61319116c80ee85701df33577d70", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/c02027b5742b5aa804ef08a4a9db433295533046", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/9084fe1b3572664ad276f427dce575f580c9799a", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/3b0becf8b1ecf642a9edaf4c9628ffc641e490d6", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/1df2dc09926f61319116c80ee85701df33577d70", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/c02027b5742b5aa804ef08a4a9db433295533046", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:24:39.913Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-47110", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-03-18T16:10:03.353776Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-23T19:01:18.430Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "x86/kvm: Disable kvmclock on all CPUs on shutdown", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "1da177e4c3f4", "lessThan": "9084fe1b3572", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f4", "lessThan": "3b0becf8b1ec", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f4", "lessThan": "1df2dc09926f", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f4", "lessThan": "c02027b5742b", "versionType": "git"}], "programFiles": ["arch/x86/include/asm/kvm_para.h", "arch/x86/kernel/kvm.c", "arch/x86/kernel/kvmclock.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "unaffected", "version": "5.4.125", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.43", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.12.10", "versionType": "semver", "lessThanOrEqual": "5.12.*"}, {"status": "unaffected", "version": "5.13", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["arch/x86/include/asm/kvm_para.h", "arch/x86/kernel/kvm.c", "arch/x86/kernel/kvmclock.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/9084fe1b3572664ad276f427dce575f580c9799a"}, {"url": "https://git.kernel.org/stable/c/3b0becf8b1ecf642a9edaf4c9628ffc641e490d6"}, {"url": "https://git.kernel.org/stable/c/1df2dc09926f61319116c80ee85701df33577d70"}, {"url": "https://git.kernel.org/stable/c/c02027b5742b5aa804ef08a4a9db433295533046"}], "x_generator": {"engine": "bippy-9e1c9544281a"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/kvm: Disable kvmclock on all CPUs on shutdown\n\nCurrenly, we disable kvmclock from machine_shutdown() hook and this\nonly happens for boot CPU. We need to disable it for all CPUs to\nguard against memory corruption e.g. on restore from hibernate.\n\nNote, writing '0' to kvmclock MSR doesn't clear memory location, it\njust prevents hypervisor from updating the location so for the short\nwhile after write and while CPU is still alive, the clock remains usable\nand correct so we don't need to switch to some other clocksource."}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-11-04T11:59:36.144Z"}}}, "cveMetadata": {"cveId": "CVE-2021-47110", "state": "PUBLISHED", "dateUpdated": "2024-11-04T11:59:36.144Z", "dateReserved": "2024-03-04T18:12:48.836Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-03-15T20:14:19.183Z", "assignerShortName": "Linux"}, "dataVersion": "5.1"}

{"bugzilla": {"description": "kernel: x86/kvm: Disable kvmclock on all CPUs on shutdown", "id": "2269873", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2269873"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "status": "draft"}, "cwe": "CWE-99", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nx86/kvm: Disable kvmclock on all CPUs on shutdown\nCurrenly, we disable kvmclock from machine_shutdown() hook and this\nonly happens for boot CPU. We need to disable it for all CPUs to\nguard against memory corruption e.g. on restore from hibernate.\nNote, writing '0' to kvmclock MSR doesn't clear memory location, it\njust prevents hypervisor from updating the location so for the short\nwhile after write and while CPU is still alive, the clock remains usable\nand correct so we don't need to switch to some other clocksource."], "name": "CVE-2021-47110", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-03-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2021-47110\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-47110\nhttps://lore.kernel.org/linux-cve-announce/2024031506-CVE-2021-47110-2cb8@gregkh/T/#u"], "threat_severity": "Low", "upstream_fix": "kernel 5.4.125, kernel 5.10.43, kernel 5.12.10, kernel 5.13"}