CVE-2021-47450 - Vulnerability Details - OpenCVE

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: Fix host stage-2 PGD refcount

The KVM page-table library refcounts the pages of concatenated stage-2
PGDs individually. However, when running KVM in protected mode, the
host's stage-2 PGD is currently managed by EL2 as a single high-order
compound page, which can cause the refcount of the tail pages to reach 0
when they shouldn't, hence corrupting the page-table.

Fix this by introducing a new hyp_split_page() helper in the EL2 page
allocator (matching the kernel's split_page() function), and make use of
it from host_s2_zalloc_pages_exact().

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00021.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Linux	Linux Kernel

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors	Products
Linux	Linux Kernel

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://git.kernel.org/stable/c/1d58a17ef54599506d44c45ac95be27273a4d2b1
https://git.kernel.org/stable/c/b372264c66ef78f2cab44e877fbd765ad6d24c39
https://lore.kernel.org/linux-cve-announce/2024052242-CVE-2021-47450-c72f@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2021-47450
https://www.cve.org/CVERecord?id=CVE-2021-47450

History

Mon, 04 Nov 2024 12:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-05-22T06:19:41.443Z

Updated: 2025-05-04T07:11:12.084Z

Reserved: 2024-05-21T14:58:30.832Z

Link: CVE-2021-47450

Vulnrichment

Updated: 2024-08-04T05:39:59.495Z

NVD

Status : Awaiting Analysis

Published: 2024-05-22T07:15:10.143

Modified: 2024-11-21T06:36:10.327

Link: CVE-2021-47450

Redhat

Severity : Low

Publid Date: 2024-05-22T00:00:00Z

Links: CVE-2021-47450 - Bugzilla

OpenCVE Enrichment

Updated: 2025-07-12T22:31:06Z

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2021-47450", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-21T14:58:30.832Z", "datePublished": "2024-05-22T06:19:41.443Z", "dateUpdated": "2025-05-04T07:11:12.084Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2025-05-04T07:11:12.084Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Fix host stage-2 PGD refcount\n\nThe KVM page-table library refcounts the pages of concatenated stage-2\nPGDs individually. However, when running KVM in protected mode, the\nhost's stage-2 PGD is currently managed by EL2 as a single high-order\ncompound page, which can cause the refcount of the tail pages to reach 0\nwhen they shouldn't, hence corrupting the page-table.\n\nFix this by introducing a new hyp_split_page() helper in the EL2 page\nallocator (matching the kernel's split_page() function), and make use of\nit from host_s2_zalloc_pages_exact()."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/arm64/kvm/hyp/include/nvhe/gfp.h", "arch/arm64/kvm/hyp/nvhe/mem_protect.c", "arch/arm64/kvm/hyp/nvhe/page_alloc.c"], "versions": [{"version": "1025c8c0c6accfcbdc8f52ca1940160f65cd87d6", "lessThan": "b372264c66ef78f2cab44e877fbd765ad6d24c39", "status": "affected", "versionType": "git"}, {"version": "1025c8c0c6accfcbdc8f52ca1940160f65cd87d6", "lessThan": "1d58a17ef54599506d44c45ac95be27273a4d2b1", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/arm64/kvm/hyp/include/nvhe/gfp.h", "arch/arm64/kvm/hyp/nvhe/mem_protect.c", "arch/arm64/kvm/hyp/nvhe/page_alloc.c"], "versions": [{"version": "5.13", "status": "affected"}, {"version": "0", "lessThan": "5.13", "status": "unaffected", "versionType": "semver"}, {"version": "5.14.15", "lessThanOrEqual": "5.14.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "5.14.15"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "5.15"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/b372264c66ef78f2cab44e877fbd765ad6d24c39"}, {"url": "https://git.kernel.org/stable/c/1d58a17ef54599506d44c45ac95be27273a4d2b1"}], "title": "KVM: arm64: Fix host stage-2 PGD refcount", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-47450", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-22T18:46:22.813390Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:14:28.577Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:39:59.495Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/b372264c66ef78f2cab44e877fbd765ad6d24c39", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/1d58a17ef54599506d44c45ac95be27273a4d2b1", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/b372264c66ef78f2cab44e877fbd765ad6d24c39", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/1d58a17ef54599506d44c45ac95be27273a4d2b1", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:39:59.495Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-47450", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-22T18:46:22.813390Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-22T18:46:50.839Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "KVM: arm64: Fix host stage-2 PGD refcount", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "1025c8c0c6accfcbdc8f52ca1940160f65cd87d6", "lessThan": "b372264c66ef78f2cab44e877fbd765ad6d24c39", "versionType": "git"}, {"status": "affected", "version": "1025c8c0c6accfcbdc8f52ca1940160f65cd87d6", "lessThan": "1d58a17ef54599506d44c45ac95be27273a4d2b1", "versionType": "git"}], "programFiles": ["arch/arm64/kvm/hyp/include/nvhe/gfp.h", "arch/arm64/kvm/hyp/nvhe/mem_protect.c", "arch/arm64/kvm/hyp/nvhe/page_alloc.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.13"}, {"status": "unaffected", "version": "0", "lessThan": "5.13", "versionType": "semver"}, {"status": "unaffected", "version": "5.14.15", "versionType": "semver", "lessThanOrEqual": "5.14.*"}, {"status": "unaffected", "version": "5.15", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["arch/arm64/kvm/hyp/include/nvhe/gfp.h", "arch/arm64/kvm/hyp/nvhe/mem_protect.c", "arch/arm64/kvm/hyp/nvhe/page_alloc.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/b372264c66ef78f2cab44e877fbd765ad6d24c39"}, {"url": "https://git.kernel.org/stable/c/1d58a17ef54599506d44c45ac95be27273a4d2b1"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Fix host stage-2 PGD refcount\n\nThe KVM page-table library refcounts the pages of concatenated stage-2\nPGDs individually. However, when running KVM in protected mode, the\nhost's stage-2 PGD is currently managed by EL2 as a single high-order\ncompound page, which can cause the refcount of the tail pages to reach 0\nwhen they shouldn't, hence corrupting the page-table.\n\nFix this by introducing a new hyp_split_page() helper in the EL2 page\nallocator (matching the kernel's split_page() function), and make use of\nit from host_s2_zalloc_pages_exact()."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.14.15", "versionStartIncluding": "5.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15", "versionStartIncluding": "5.13"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2025-05-04T07:11:12.084Z"}}}, "cveMetadata": {"cveId": "CVE-2021-47450", "state": "PUBLISHED", "dateUpdated": "2025-05-04T07:11:12.084Z", "dateReserved": "2024-05-21T14:58:30.832Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-05-22T06:19:41.443Z", "assignerShortName": "Linux"}, "dataVersion": "5.1"}

{"bugzilla": {"description": "kernel: KVM: arm64: Fix host stage-2 PGD refcount", "id": "2282909", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2282909"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-99", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nKVM: arm64: Fix host stage-2 PGD refcount\nThe KVM page-table library refcounts the pages of concatenated stage-2\nPGDs individually. However, when running KVM in protected mode, the\nhost's stage-2 PGD is currently managed by EL2 as a single high-order\ncompound page, which can cause the refcount of the tail pages to reach 0\nwhen they shouldn't, hence corrupting the page-table.\nFix this by introducing a new hyp_split_page() helper in the EL2 page\nallocator (matching the kernel's split_page() function), and make use of\nit from host_s2_zalloc_pages_exact()."], "name": "CVE-2021-47450", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-05-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2021-47450\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-47450\nhttps://lore.kernel.org/linux-cve-announce/2024052242-CVE-2021-47450-c72f@gregkh/T"], "threat_severity": "Low"}