Vulnerability-Lookup

GHSA-FQ4Q-X842-FMRH

Vulnerability from github – Published: 2024-03-15 21:30 – Updated: 2025-03-13 21:31

Details

In the Linux kernel, the following vulnerability has been resolved:

x86/kvm: Teardown PV features on boot CPU as well

Various PV features (Async PF, PV EOI, steal time) work through memory shared with hypervisor and when we restore from hibernation we must properly teardown all these features to make sure hypervisor doesn't write to stale locations after we jump to the previously hibernated kernel (which can try to place anything there). For secondary CPUs the job is already done by kvm_cpu_down_prepare(), register syscore ops to do the same for boot CPU.

Severity

5.5 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2021-47112"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-15T21:15:06Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/kvm: Teardown PV features on boot CPU as well\n\nVarious PV features (Async PF, PV EOI, steal time) work through memory\nshared with hypervisor and when we restore from hibernation we must\nproperly teardown all these features to make sure hypervisor doesn\u0027t\nwrite to stale locations after we jump to the previously hibernated kernel\n(which can try to place anything there). For secondary CPUs the job is\nalready done by kvm_cpu_down_prepare(), register syscore ops to do\nthe same for boot CPU.",
  "id": "GHSA-fq4q-x842-fmrh",
  "modified": "2025-03-13T21:31:00Z",
  "published": "2024-03-15T21:30:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47112"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/38b858da1c58ad46519a257764e059e663b59ff2"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/7620a669111b52f224d006dea9e1e688e2d62c54"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/8b79feffeca28c5459458fe78676b081e87c93a4"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/d1629b5b925de9b27979e929dae7fcb766daf6b6"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2021-47112 (GCVE-0-2021-47112)

Vulnerability from cvelistv5 – Published: 2024-03-15 20:14 – Updated: 2026-08-05 08:46

Title

x86/kvm: Teardown PV features on boot CPU as well

Summary

In the Linux kernel, the following vulnerability has been resolved: x86/kvm: Teardown PV features on boot CPU as well Various PV features (Async PF, PV EOI, steal time) work through memory shared with hypervisor and when we restore from hibernation we must properly teardown all these features to make sure hypervisor doesn't write to stale locations after we jump to the previously hibernated kernel (which can try to place anything there). For secondary CPUs the job is already done by kvm_cpu_down_prepare(), register syscore ops to do the same for boot CPU.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-03-18 20:26 UTC

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6992 records in the last 180 days details

References

4 references

URL	Tags
https://git.kernel.org/stable/c/7620a669111b52f22…
https://git.kernel.org/stable/c/38b858da1c58ad465…
https://git.kernel.org/stable/c/d1629b5b925de9b27…
https://git.kernel.org/stable/c/8b79feffeca28c545…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: fd10cde9294f73eeccbc16f3fec1ae6cde7b800c , < 7620a669111b52f224d006dea9e1e688e2d62c54 (git) Affected: fd10cde9294f73eeccbc16f3fec1ae6cde7b800c , < 38b858da1c58ad46519a257764e059e663b59ff2 (git) Affected: fd10cde9294f73eeccbc16f3fec1ae6cde7b800c , < d1629b5b925de9b27979e929dae7fcb766daf6b6 (git) Affected: fd10cde9294f73eeccbc16f3fec1ae6cde7b800c , < 8b79feffeca28c5459458fe78676b081e87c93a4 (git)
Linux	Linux	Affected: 2.6.38 Unaffected: 0 , < 2.6.38 (semver) Unaffected: 5.4.125 , ≤ 5.4.* (semver) Unaffected: 5.10.43 , ≤ 5.10.* (semver) Unaffected: 5.12.10 , ≤ 5.12.* (semver) Unaffected: 5.13 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47112",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-18T20:26:26.037473Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:14:29.430Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:24:39.829Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/7620a669111b52f224d006dea9e1e688e2d62c54"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/38b858da1c58ad46519a257764e059e663b59ff2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d1629b5b925de9b27979e929dae7fcb766daf6b6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8b79feffeca28c5459458fe78676b081e87c93a4"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kernel/kvm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7620a669111b52f224d006dea9e1e688e2d62c54",
              "status": "affected",
              "version": "fd10cde9294f73eeccbc16f3fec1ae6cde7b800c",
              "versionType": "git"
            },
            {
              "lessThan": "38b858da1c58ad46519a257764e059e663b59ff2",
              "status": "affected",
              "version": "fd10cde9294f73eeccbc16f3fec1ae6cde7b800c",
              "versionType": "git"
            },
            {
              "lessThan": "d1629b5b925de9b27979e929dae7fcb766daf6b6",
              "status": "affected",
              "version": "fd10cde9294f73eeccbc16f3fec1ae6cde7b800c",
              "versionType": "git"
            },
            {
              "lessThan": "8b79feffeca28c5459458fe78676b081e87c93a4",
              "status": "affected",
              "version": "fd10cde9294f73eeccbc16f3fec1ae6cde7b800c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kernel/kvm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.38"
            },
            {
              "lessThan": "2.6.38",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.125",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.43",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.12.*",
              "status": "unaffected",
              "version": "5.12.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.125",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.43",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.12.10",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.13",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/kvm: Teardown PV features on boot CPU as well\n\nVarious PV features (Async PF, PV EOI, steal time) work through memory\nshared with hypervisor and when we restore from hibernation we must\nproperly teardown all these features to make sure hypervisor doesn\u0027t\nwrite to stale locations after we jump to the previously hibernated kernel\n(which can try to place anything there). For secondary CPUs the job is\nalready done by kvm_cpu_down_prepare(), register syscore ops to do\nthe same for boot CPU."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is in guest-side KVM paravirt code (arch/x86/kernel/kvm.c) and is reached only when the guest performs local hibernation/suspend-to-disk (write to /sys/power/state or logind), not via network packets or adjacent-link protocols.\nAC:L - On a KVM guest with PV features (steal time/PV EOI/async PF), initiating hibernate/resume cycles deterministically leaves boot-CPU PV MSRs enabled so the hypervisor keeps writing shared structures; Ubuntu reproduced reliable memory corruption after repeated hibernate/resume with no attacker-uncontrollable race.\nPR:L - An active local seat user can trigger hibernate/suspend through logind/polkit without real init-namespace root, matching the worst reasonable desktop/laptop KVM-guest deployment; this does not require capabilities obtainable only outside user namespaces.\nUI:N - The attacker initiates hibernation/resume themselves (or the same path is entered by session autosleep); no separate victim action such as mounting a filesystem or opening a crafted file is required.\nS:U - Impact is memory corruption inside the guest kernel from incomplete PV teardown; this is not a guest-to-host escape, IOMMU bypass, or other cross-authority breakout (the host already fully controls guest memory).\nC:H - Hypervisor writes into stale guest GPAs after resume corrupt arbitrary kernel pages that reused those locations (observed page-flag corruption); such kernel memory corruption can be leveraged for information disclosure.\nI:H - The same stale-GPA writes are kernel memory corruption (page metadata and whatever structures land at the still-registered GPAs), which is exploitable for integrity break / control-flow hijacking under the higher-severity memory-corruption guidance.\nA:H - The corruption manifests as BUG: Bad page state / page-allocator failures and can oops/panic or otherwise crash the guest kernel after hibernation resume, fully denying availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:46:05.685Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7620a669111b52f224d006dea9e1e688e2d62c54"
        },
        {
          "url": "https://git.kernel.org/stable/c/38b858da1c58ad46519a257764e059e663b59ff2"
        },
        {
          "url": "https://git.kernel.org/stable/c/d1629b5b925de9b27979e929dae7fcb766daf6b6"
        },
        {
          "url": "https://git.kernel.org/stable/c/8b79feffeca28c5459458fe78676b081e87c93a4"
        }
      ],
      "title": "x86/kvm: Teardown PV features on boot CPU as well",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47112",
    "datePublished": "2024-03-15T20:14:20.602Z",
    "dateReserved": "2024-03-04T18:12:48.836Z",
    "dateUpdated": "2026-08-05T08:46:05.685Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted