Vulnerability-Lookup

GHSA-2PRC-4F47-P38V

Vulnerability from github – Published: 2024-02-27 21:31 – Updated: 2024-12-06 18:30

Details

In the Linux kernel, the following vulnerability has been resolved:

vhost-vdpa: fix vm_flags for virtqueue doorbell mapping

The virtqueue doorbell is usually implemented via registeres but we don't provide the necessary vma->flags like VM_PFNMAP. This may cause several issues e.g when userspace tries to map the doorbell via vhost IOTLB, kernel may panic due to the page is not backed by page structure. This patch fixes this by setting the necessary vm_flags. With this patch, try to map doorbell via IOTLB will fail with bad address.

Severity

5.5 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2021-46967"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-02-27T19:04:07Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nvhost-vdpa: fix vm_flags for virtqueue doorbell mapping\n\nThe virtqueue doorbell is usually implemented via registeres but we\ndon\u0027t provide the necessary vma-\u003eflags like VM_PFNMAP. This may cause\nseveral issues e.g when userspace tries to map the doorbell via vhost\nIOTLB, kernel may panic due to the page is not backed by page\nstructure. This patch fixes this by setting the necessary\nvm_flags. With this patch, try to map doorbell via IOTLB will fail\nwith bad address.",
  "id": "GHSA-2prc-4f47-p38v",
  "modified": "2024-12-06T18:30:44Z",
  "published": "2024-02-27T21:31:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-46967"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/3a3e0fad16d40a2aa68ddf7eea4acdf48b22dd44"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/3b8b6399666a29daa30b0bb3f5c9e3fc81c5a6a6"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/93dbbf20e3ffad14f04227a0b7105f6e6f0387ce"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/940230a5c31e2714722aee04c521a21f484b4df7"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2021-46967 (GCVE-0-2021-46967)

Vulnerability from cvelistv5 – Published: 2024-02-27 18:47 – Updated: 2026-08-05 08:45

Title

vhost-vdpa: fix vm_flags for virtqueue doorbell mapping

Summary

In the Linux kernel, the following vulnerability has been resolved: vhost-vdpa: fix vm_flags for virtqueue doorbell mapping The virtqueue doorbell is usually implemented via registeres but we don't provide the necessary vma->flags like VM_PFNMAP. This may cause several issues e.g when userspace tries to map the doorbell via vhost IOTLB, kernel may panic due to the page is not backed by page structure. This patch fixes this by setting the necessary vm_flags. With this patch, try to map doorbell via IOTLB will fail with bad address.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-02-27 19:32 UTC

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6843 records in the last 180 days details

References

4 references

URL	Tags
https://git.kernel.org/stable/c/3b8b6399666a29daa…
https://git.kernel.org/stable/c/940230a5c31e27147…
https://git.kernel.org/stable/c/93dbbf20e3ffad14f…
https://git.kernel.org/stable/c/3a3e0fad16d40a2aa…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: ddd89d0a059d8e9740c75a97e0efe9bf07ee51f9 , < 3b8b6399666a29daa30b0bb3f5c9e3fc81c5a6a6 (git) Affected: ddd89d0a059d8e9740c75a97e0efe9bf07ee51f9 , < 940230a5c31e2714722aee04c521a21f484b4df7 (git) Affected: ddd89d0a059d8e9740c75a97e0efe9bf07ee51f9 , < 93dbbf20e3ffad14f04227a0b7105f6e6f0387ce (git) Affected: ddd89d0a059d8e9740c75a97e0efe9bf07ee51f9 , < 3a3e0fad16d40a2aa68ddf7eea4acdf48b22dd44 (git)
Linux	Linux	Affected: 5.8 Unaffected: 0 , < 5.8 (semver) Unaffected: 5.10.36 , ≤ 5.10.* (semver) Unaffected: 5.11.20 , ≤ 5.11.* (semver) Unaffected: 5.12.3 , ≤ 5.12.* (semver) Unaffected: 5.13 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-46967",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-27T19:32:37.039372Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:13:04.232Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:17:43.025Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3b8b6399666a29daa30b0bb3f5c9e3fc81c5a6a6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/940230a5c31e2714722aee04c521a21f484b4df7"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/93dbbf20e3ffad14f04227a0b7105f6e6f0387ce"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3a3e0fad16d40a2aa68ddf7eea4acdf48b22dd44"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/vhost/vdpa.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3b8b6399666a29daa30b0bb3f5c9e3fc81c5a6a6",
              "status": "affected",
              "version": "ddd89d0a059d8e9740c75a97e0efe9bf07ee51f9",
              "versionType": "git"
            },
            {
              "lessThan": "940230a5c31e2714722aee04c521a21f484b4df7",
              "status": "affected",
              "version": "ddd89d0a059d8e9740c75a97e0efe9bf07ee51f9",
              "versionType": "git"
            },
            {
              "lessThan": "93dbbf20e3ffad14f04227a0b7105f6e6f0387ce",
              "status": "affected",
              "version": "ddd89d0a059d8e9740c75a97e0efe9bf07ee51f9",
              "versionType": "git"
            },
            {
              "lessThan": "3a3e0fad16d40a2aa68ddf7eea4acdf48b22dd44",
              "status": "affected",
              "version": "ddd89d0a059d8e9740c75a97e0efe9bf07ee51f9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/vhost/vdpa.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.8"
            },
            {
              "lessThan": "5.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.11.*",
              "status": "unaffected",
              "version": "5.11.20",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.12.*",
              "status": "unaffected",
              "version": "5.12.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.36",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.11.20",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.12.3",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.13",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvhost-vdpa: fix vm_flags for virtqueue doorbell mapping\n\nThe virtqueue doorbell is usually implemented via registeres but we\ndon\u0027t provide the necessary vma-\u003eflags like VM_PFNMAP. This may cause\nseveral issues e.g when userspace tries to map the doorbell via vhost\nIOTLB, kernel may panic due to the page is not backed by page\nstructure. This patch fixes this by setting the necessary\nvm_flags. With this patch, try to map doorbell via IOTLB will fail\nwith bad address."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only via local open/mmap/ioctl on `/dev/vhost-vdpa-N` (mmap of the virtqueue doorbell, then a vhost IOTLB update on that uaddr), not via network packets or adjacent-link protocols.\nAC:L - An attacker who can open the device can deterministically mmap the doorbell and submit a VHOST_IOTLB_UPDATE for that address without depending on races, special memory layout, or other conditions outside their control.\nPR:L - There is no capability check on the open/mmap/IOTLB path; access is gated only by DAC on the vhost-vdpa node, which in standard libvirt/QEMU deployments is held by an unprivileged VMM account (same model as CVE-2024-47748).\nUI:N - The attacker performs the mmap and IOTLB update from their own process; no separate victim action is required.\nS:U - Impact is confined to the host kernel authority that already owns the vhost-vdpa/IOTLB path; this is not a guest-to-host escape or an exploit whose defining effect is crossing an IOMMU/VM boundary.\nC:H - Without VM_PFNMAP, IOTLB pinning of the doorbell can proceed into GUP\u2019s PFNMAP -EEXIST path, which in the affected kernels left page_list entries unset so page_to_pfn/IOMMU map operate on attacker-influenced garbage, enabling arbitrary physical-memory disclosure via bad DMA maps.\nI:H - The same uninitialized-page / wrong-PFN IOTLB install and later pfn_to_page/unpin_user_page teardown provide kernel memory corruption and arbitrary DMA write primitives against host physical memory.\nA:H - The fix explicitly documents that mapping the doorbell via vhost IOTLB can panic the kernel because the page is not backed by a struct page, which is High availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:45:17.104Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3b8b6399666a29daa30b0bb3f5c9e3fc81c5a6a6"
        },
        {
          "url": "https://git.kernel.org/stable/c/940230a5c31e2714722aee04c521a21f484b4df7"
        },
        {
          "url": "https://git.kernel.org/stable/c/93dbbf20e3ffad14f04227a0b7105f6e6f0387ce"
        },
        {
          "url": "https://git.kernel.org/stable/c/3a3e0fad16d40a2aa68ddf7eea4acdf48b22dd44"
        }
      ],
      "title": "vhost-vdpa: fix vm_flags for virtqueue doorbell mapping",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-46967",
    "datePublished": "2024-02-27T18:47:04.253Z",
    "dateReserved": "2024-02-27T18:42:55.943Z",
    "dateUpdated": "2026-08-05T08:45:17.104Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted