Vulnerability Details CVE-2021-29657
arch/x86/kvm/svm/nested.c in the Linux kernel before 5.11.12 has a use-after-free in which an AMD KVM guest can bypass access control on host OS MSRs when there are nested guests, aka CID-a58d9166a756. This occurs because of a TOCTOU race condition associated with a VMCB12 double fetch in nested_svm_vmrun.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 1.4%
CVSS Severity
CVSS v3 Score 7.4
CVSS v2 Score 6.9
References
- http://packetstormsecurity.com/files/163324/KVM-nested_svm_vmrun-Double-Fetch.html
- https://bugs.chromium.org/p/project-zero/issues/detail?id=2177
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.11.12
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a58d9166a756a0f4a6618e4f593232593d6df134
- https://security.netapp.com/advisory/ntap-20210902-0008/
- http://packetstormsecurity.com/files/163324/KVM-nested_svm_vmrun-Double-Fetch.html
- https://bugs.chromium.org/p/project-zero/issues/detail?id=2177
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.11.12
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a58d9166a756a0f4a6618e4f593232593d6df134
- https://security.netapp.com/advisory/ntap-20210902-0008/
Products affected by CVE-2021-29657
-
cpe:2.3:o:linux:linux_kernel:5.10
-
cpe:2.3:o:linux:linux_kernel:5.10.0
-
cpe:2.3:o:linux:linux_kernel:5.10.1
-
cpe:2.3:o:linux:linux_kernel:5.10.10
-
cpe:2.3:o:linux:linux_kernel:5.10.11
-
cpe:2.3:o:linux:linux_kernel:5.10.12
-
cpe:2.3:o:linux:linux_kernel:5.10.13
-
cpe:2.3:o:linux:linux_kernel:5.10.14
-
cpe:2.3:o:linux:linux_kernel:5.10.15
-
cpe:2.3:o:linux:linux_kernel:5.10.16
-
cpe:2.3:o:linux:linux_kernel:5.10.17
-
cpe:2.3:o:linux:linux_kernel:5.10.18
-
cpe:2.3:o:linux:linux_kernel:5.10.19
-
cpe:2.3:o:linux:linux_kernel:5.10.2
-
cpe:2.3:o:linux:linux_kernel:5.10.20
-
cpe:2.3:o:linux:linux_kernel:5.10.21
-
cpe:2.3:o:linux:linux_kernel:5.10.22
-
cpe:2.3:o:linux:linux_kernel:5.10.23
-
cpe:2.3:o:linux:linux_kernel:5.10.24
-
cpe:2.3:o:linux:linux_kernel:5.10.25
-
cpe:2.3:o:linux:linux_kernel:5.10.26
-
cpe:2.3:o:linux:linux_kernel:5.10.27
-
cpe:2.3:o:linux:linux_kernel:5.10.3
-
cpe:2.3:o:linux:linux_kernel:5.10.4
-
cpe:2.3:o:linux:linux_kernel:5.10.5
-
cpe:2.3:o:linux:linux_kernel:5.10.6
-
cpe:2.3:o:linux:linux_kernel:5.10.7
-
cpe:2.3:o:linux:linux_kernel:5.10.8
-
cpe:2.3:o:linux:linux_kernel:5.10.9
-
cpe:2.3:o:linux:linux_kernel:5.11
-
cpe:2.3:o:linux:linux_kernel:5.11.1
-
cpe:2.3:o:linux:linux_kernel:5.11.10
-
cpe:2.3:o:linux:linux_kernel:5.11.11
-
cpe:2.3:o:linux:linux_kernel:5.11.2
-
cpe:2.3:o:linux:linux_kernel:5.11.3
-
cpe:2.3:o:linux:linux_kernel:5.11.4
-
cpe:2.3:o:linux:linux_kernel:5.11.5
-
cpe:2.3:o:linux:linux_kernel:5.11.6
-
cpe:2.3:o:linux:linux_kernel:5.11.7
-
cpe:2.3:o:linux:linux_kernel:5.11.8
-
cpe:2.3:o:linux:linux_kernel:5.11.9