CVE-2021-47450 - OpenCVE

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix host stage-2 PGD refcount The KVM page-table library refcounts the pages of concatenated stage-2 PGDs individually. However, when running KVM in protected mode, the host's stage-2 PGD is currently managed by EL2 as a single high-order compound page, which can cause the refcount of the tail pages to reach 0 when they shouldn't, hence corrupting the page-table. Fix this by introducing a new hyp_split_page() helper in the EL2 page allocator (matching the kernel's split_page() function), and make use of it from host_s2_zalloc_pages_exact().

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://git.kernel.org/stable/c/1d58a17ef54599506d44c45ac95be27273a4d2b1
https://git.kernel.org/stable/c/b372264c66ef78f2cab44e877fbd765ad6d24c39
https://lore.kernel.org/linux-cve-announce/2024052242-CVE-2021-47450-c72f@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2021-47450
https://www.cve.org/CVERecord?id=CVE-2021-47450

History

Mon, 04 Nov 2024 12:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-05-22T06:19:41.443Z

Updated: 2024-11-04T12:06:08.607Z

Reserved: 2024-05-21T14:58:30.832Z

Link: CVE-2021-47450

Vulnrichment

Updated: 2024-08-04T05:39:59.495Z

NVD

Status : Awaiting Analysis

Published: 2024-05-22T07:15:10.143

Modified: 2024-05-22T12:46:53.887

Link: CVE-2021-47450

Redhat

Severity : Low

Publid Date: 2024-05-22T00:00:00Z

Links: CVE-2021-47450 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2021-47450", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-21T14:58:30.832Z", "datePublished": "2024-05-22T06:19:41.443Z", "dateUpdated": "2024-11-04T12:06:08.607Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-11-04T12:06:08.607Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Fix host stage-2 PGD refcount\n\nThe KVM page-table library refcounts the pages of concatenated stage-2\nPGDs individually. However, when running KVM in protected mode, the\nhost's stage-2 PGD is currently managed by EL2 as a single high-order\ncompound page, which can cause the refcount of the tail pages to reach 0\nwhen they shouldn't, hence corrupting the page-table.\n\nFix this by introducing a new hyp_split_page() helper in the EL2 page\nallocator (matching the kernel's split_page() function), and make use of\nit from host_s2_zalloc_pages_exact()."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/arm64/kvm/hyp/include/nvhe/gfp.h", "arch/arm64/kvm/hyp/nvhe/mem_protect.c", "arch/arm64/kvm/hyp/nvhe/page_alloc.c"], "versions": [{"version": "1025c8c0c6ac", "lessThan": "b372264c66ef", "status": "affected", "versionType": "git"}, {"version": "1025c8c0c6ac", "lessThan": "1d58a17ef545", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/arm64/kvm/hyp/include/nvhe/gfp.h", "arch/arm64/kvm/hyp/nvhe/mem_protect.c", "arch/arm64/kvm/hyp/nvhe/page_alloc.c"], "versions": [{"version": "5.13", "status": "affected"}, {"version": "0", "lessThan": "5.13", "status": "unaffected", "versionType": "semver"}, {"version": "5.14.15", "lessThanOrEqual": "5.14.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "references": [{"url": "https://git.kernel.org/stable/c/b372264c66ef78f2cab44e877fbd765ad6d24c39"}, {"url": "https://git.kernel.org/stable/c/1d58a17ef54599506d44c45ac95be27273a4d2b1"}], "title": "KVM: arm64: Fix host stage-2 PGD refcount", "x_generator": {"engine": "bippy-9e1c9544281a"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-47450", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-22T18:46:22.813390Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:14:28.577Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:39:59.495Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/b372264c66ef78f2cab44e877fbd765ad6d24c39", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/1d58a17ef54599506d44c45ac95be27273a4d2b1", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/b372264c66ef78f2cab44e877fbd765ad6d24c39", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/1d58a17ef54599506d44c45ac95be27273a4d2b1", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:39:59.495Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-47450", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-22T18:46:22.813390Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-22T18:46:50.839Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "KVM: arm64: Fix host stage-2 PGD refcount", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "1025c8c0c6ac", "lessThan": "b372264c66ef", "versionType": "git"}, {"status": "affected", "version": "1025c8c0c6ac", "lessThan": "1d58a17ef545", "versionType": "git"}], "programFiles": ["arch/arm64/kvm/hyp/include/nvhe/gfp.h", "arch/arm64/kvm/hyp/nvhe/mem_protect.c", "arch/arm64/kvm/hyp/nvhe/page_alloc.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.13"}, {"status": "unaffected", "version": "0", "lessThan": "5.13", "versionType": "semver"}, {"status": "unaffected", "version": "5.14.15", "versionType": "semver", "lessThanOrEqual": "5.14.*"}, {"status": "unaffected", "version": "5.15", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["arch/arm64/kvm/hyp/include/nvhe/gfp.h", "arch/arm64/kvm/hyp/nvhe/mem_protect.c", "arch/arm64/kvm/hyp/nvhe/page_alloc.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/b372264c66ef78f2cab44e877fbd765ad6d24c39"}, {"url": "https://git.kernel.org/stable/c/1d58a17ef54599506d44c45ac95be27273a4d2b1"}], "x_generator": {"engine": "bippy-9e1c9544281a"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Fix host stage-2 PGD refcount\n\nThe KVM page-table library refcounts the pages of concatenated stage-2\nPGDs individually. However, when running KVM in protected mode, the\nhost's stage-2 PGD is currently managed by EL2 as a single high-order\ncompound page, which can cause the refcount of the tail pages to reach 0\nwhen they shouldn't, hence corrupting the page-table.\n\nFix this by introducing a new hyp_split_page() helper in the EL2 page\nallocator (matching the kernel's split_page() function), and make use of\nit from host_s2_zalloc_pages_exact()."}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-11-04T12:06:08.607Z"}}}, "cveMetadata": {"cveId": "CVE-2021-47450", "state": "PUBLISHED", "dateUpdated": "2024-11-04T12:06:08.607Z", "dateReserved": "2024-05-21T14:58:30.832Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-05-22T06:19:41.443Z", "assignerShortName": "Linux"}, "dataVersion": "5.1"}

{"bugzilla": {"description": "kernel: KVM: arm64: Fix host stage-2 PGD refcount", "id": "2282909", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2282909"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-99", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nKVM: arm64: Fix host stage-2 PGD refcount\nThe KVM page-table library refcounts the pages of concatenated stage-2\nPGDs individually. However, when running KVM in protected mode, the\nhost's stage-2 PGD is currently managed by EL2 as a single high-order\ncompound page, which can cause the refcount of the tail pages to reach 0\nwhen they shouldn't, hence corrupting the page-table.\nFix this by introducing a new hyp_split_page() helper in the EL2 page\nallocator (matching the kernel's split_page() function), and make use of\nit from host_s2_zalloc_pages_exact()."], "name": "CVE-2021-47450", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-05-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2021-47450\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-47450\nhttps://lore.kernel.org/linux-cve-announce/2024052242-CVE-2021-47450-c72f@gregkh/T"], "threat_severity": "Low", "upstream_fix": "kernel 5.14.15, kernel 5.15"}