CVE-2021-47639 (GCVE-0-2021-47639)
Vulnerability from cvelistv5
Published
2025-02-26 01:54
Modified
2025-05-04 07:15
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Zap _all_ roots when unmapping gfn range in TDP MMU Zap both valid and invalid roots when zapping/unmapping a gfn range, as KVM must ensure it holds no references to the freed page after returning from the unmap operation. Most notably, the TDP MMU doesn't zap invalid roots in mmu_notifier callbacks. This leads to use-after-free and other issues if the mmu_notifier runs to completion while an invalid root zapper yields as KVM fails to honor the requirement that there must be _no_ references to the page after the mmu_notifier returns. The bug is most easily reproduced by hacking KVM to cause a collision between set_nx_huge_pages() and kvm_mmu_notifier_release(), but the bug exists between kvm_mmu_notifier_invalidate_range_start() and memslot updates as well. Invalidating a root ensures pages aren't accessible by the guest, and KVM won't read or write page data itself, but KVM will trigger e.g. kvm_set_pfn_dirty() when zapping SPTEs, and thus completing a zap of an invalid root _after_ the mmu_notifier returns is fatal. WARNING: CPU: 24 PID: 1496 at arch/x86/kvm/../../../virt/kvm/kvm_main.c:173 [kvm] RIP: 0010:kvm_is_zone_device_pfn+0x96/0xa0 [kvm] Call Trace: <TASK> kvm_set_pfn_dirty+0xa8/0xe0 [kvm] __handle_changed_spte+0x2ab/0x5e0 [kvm] __handle_changed_spte+0x2ab/0x5e0 [kvm] __handle_changed_spte+0x2ab/0x5e0 [kvm] zap_gfn_range+0x1f3/0x310 [kvm] kvm_tdp_mmu_zap_invalidated_roots+0x50/0x90 [kvm] kvm_mmu_zap_all_fast+0x177/0x1a0 [kvm] set_nx_huge_pages+0xb4/0x190 [kvm] param_attr_store+0x70/0x100 module_attr_store+0x19/0x30 kernfs_fop_write_iter+0x119/0x1b0 new_sync_write+0x11c/0x1b0 vfs_write+0x1cc/0x270 ksys_write+0x5f/0xe0 do_syscall_64+0x38/0xc0 entry_SYSCALL_64_after_hwframe+0x44/0xae </TASK>
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/0c8a8da182d4333d9bbb9131d765145568c847b2Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/8cf6f98ab1d16d5e607635a0c21c4231eb15367ePatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/af47248407c0c5ae52a752af1ab5ce5b0db91502Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/d62007edf01f5c11f75d0f4b1e538fc52a5b1982Patch
Impacted products
Vendor Product Version
Linux Linux Version: b7cccd397f310739fb85383033e95580f99927e0
Version: b7cccd397f310739fb85383033e95580f99927e0
Version: b7cccd397f310739fb85383033e95580f99927e0
Version: b7cccd397f310739fb85383033e95580f99927e0
 Create a notification for this product.
   Linux Linux Version: 5.13
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2021-47639",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-27T18:17:52.744634Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-27T18:22:35.903Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/mmu/tdp_mmu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "af47248407c0c5ae52a752af1ab5ce5b0db91502",
              "status": "affected",
              "version": "b7cccd397f310739fb85383033e95580f99927e0",
              "versionType": "git"
            },
            {
              "lessThan": "0c8a8da182d4333d9bbb9131d765145568c847b2",
              "status": "affected",
              "version": "b7cccd397f310739fb85383033e95580f99927e0",
              "versionType": "git"
            },
            {
              "lessThan": "8cf6f98ab1d16d5e607635a0c21c4231eb15367e",
              "status": "affected",
              "version": "b7cccd397f310739fb85383033e95580f99927e0",
              "versionType": "git"
            },
            {
              "lessThan": "d62007edf01f5c11f75d0f4b1e538fc52a5b1982",
              "status": "affected",
              "version": "b7cccd397f310739fb85383033e95580f99927e0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/mmu/tdp_mmu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.13"
            },
            {
              "lessThan": "5.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.16.*",
              "status": "unaffected",
              "version": "5.16.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.17.*",
              "status": "unaffected",
              "version": "5.17.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.33",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16.19",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.2",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86/mmu: Zap _all_ roots when unmapping gfn range in TDP MMU\n\nZap both valid and invalid roots when zapping/unmapping a gfn range, as\nKVM must ensure it holds no references to the freed page after returning\nfrom the unmap operation.  Most notably, the TDP MMU doesn\u0027t zap invalid\nroots in mmu_notifier callbacks.  This leads to use-after-free and other\nissues if the mmu_notifier runs to completion while an invalid root\nzapper yields as KVM fails to honor the requirement that there must be\n_no_ references to the page after the mmu_notifier returns.\n\nThe bug is most easily reproduced by hacking KVM to cause a collision\nbetween set_nx_huge_pages() and kvm_mmu_notifier_release(), but the bug\nexists between kvm_mmu_notifier_invalidate_range_start() and memslot\nupdates as well.  Invalidating a root ensures pages aren\u0027t accessible by\nthe guest, and KVM won\u0027t read or write page data itself, but KVM will\ntrigger e.g. kvm_set_pfn_dirty() when zapping SPTEs, and thus completing\na zap of an invalid root _after_ the mmu_notifier returns is fatal.\n\n  WARNING: CPU: 24 PID: 1496 at arch/x86/kvm/../../../virt/kvm/kvm_main.c:173 [kvm]\n  RIP: 0010:kvm_is_zone_device_pfn+0x96/0xa0 [kvm]\n  Call Trace:\n   \u003cTASK\u003e\n   kvm_set_pfn_dirty+0xa8/0xe0 [kvm]\n   __handle_changed_spte+0x2ab/0x5e0 [kvm]\n   __handle_changed_spte+0x2ab/0x5e0 [kvm]\n   __handle_changed_spte+0x2ab/0x5e0 [kvm]\n   zap_gfn_range+0x1f3/0x310 [kvm]\n   kvm_tdp_mmu_zap_invalidated_roots+0x50/0x90 [kvm]\n   kvm_mmu_zap_all_fast+0x177/0x1a0 [kvm]\n   set_nx_huge_pages+0xb4/0x190 [kvm]\n   param_attr_store+0x70/0x100\n   module_attr_store+0x19/0x30\n   kernfs_fop_write_iter+0x119/0x1b0\n   new_sync_write+0x11c/0x1b0\n   vfs_write+0x1cc/0x270\n   ksys_write+0x5f/0xe0\n   do_syscall_64+0x38/0xc0\n   entry_SYSCALL_64_after_hwframe+0x44/0xae\n   \u003c/TASK\u003e"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T07:15:18.607Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/af47248407c0c5ae52a752af1ab5ce5b0db91502"
        },
        {
          "url": "https://git.kernel.org/stable/c/0c8a8da182d4333d9bbb9131d765145568c847b2"
        },
        {
          "url": "https://git.kernel.org/stable/c/8cf6f98ab1d16d5e607635a0c21c4231eb15367e"
        },
        {
          "url": "https://git.kernel.org/stable/c/d62007edf01f5c11f75d0f4b1e538fc52a5b1982"
        }
      ],
      "title": "KVM: x86/mmu: Zap _all_ roots when unmapping gfn range in TDP MMU",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47639",
    "datePublished": "2025-02-26T01:54:11.651Z",
    "dateReserved": "2025-02-26T01:48:21.519Z",
    "dateUpdated": "2025-05-04T07:15:18.607Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-47639\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-02-26T06:37:05.677\",\"lastModified\":\"2025-03-24T17:47:07.143\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nKVM: x86/mmu: Zap _all_ roots when unmapping gfn range in TDP MMU\\n\\nZap both valid and invalid roots when zapping/unmapping a gfn range, as\\nKVM must ensure it holds no references to the freed page after returning\\nfrom the unmap operation.  Most notably, the TDP MMU doesn\u0027t zap invalid\\nroots in mmu_notifier callbacks.  This leads to use-after-free and other\\nissues if the mmu_notifier runs to completion while an invalid root\\nzapper yields as KVM fails to honor the requirement that there must be\\n_no_ references to the page after the mmu_notifier returns.\\n\\nThe bug is most easily reproduced by hacking KVM to cause a collision\\nbetween set_nx_huge_pages() and kvm_mmu_notifier_release(), but the bug\\nexists between kvm_mmu_notifier_invalidate_range_start() and memslot\\nupdates as well.  Invalidating a root ensures pages aren\u0027t accessible by\\nthe guest, and KVM won\u0027t read or write page data itself, but KVM will\\ntrigger e.g. kvm_set_pfn_dirty() when zapping SPTEs, and thus completing\\na zap of an invalid root _after_ the mmu_notifier returns is fatal.\\n\\n  WARNING: CPU: 24 PID: 1496 at arch/x86/kvm/../../../virt/kvm/kvm_main.c:173 [kvm]\\n  RIP: 0010:kvm_is_zone_device_pfn+0x96/0xa0 [kvm]\\n  Call Trace:\\n   \u003cTASK\u003e\\n   kvm_set_pfn_dirty+0xa8/0xe0 [kvm]\\n   __handle_changed_spte+0x2ab/0x5e0 [kvm]\\n   __handle_changed_spte+0x2ab/0x5e0 [kvm]\\n   __handle_changed_spte+0x2ab/0x5e0 [kvm]\\n   zap_gfn_range+0x1f3/0x310 [kvm]\\n   kvm_tdp_mmu_zap_invalidated_roots+0x50/0x90 [kvm]\\n   kvm_mmu_zap_all_fast+0x177/0x1a0 [kvm]\\n   set_nx_huge_pages+0xb4/0x190 [kvm]\\n   param_attr_store+0x70/0x100\\n   module_attr_store+0x19/0x30\\n   kernfs_fop_write_iter+0x119/0x1b0\\n   new_sync_write+0x11c/0x1b0\\n   vfs_write+0x1cc/0x270\\n   ksys_write+0x5f/0xe0\\n   do_syscall_64+0x38/0xc0\\n   entry_SYSCALL_64_after_hwframe+0x44/0xae\\n   \u003c/TASK\u003e\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: KVM: x86/mmu: Se eliminan _todos_ las ra\u00edces al anular la asignaci\u00f3n del rango gfn en TDP MMU Se eliminan las ra\u00edces v\u00e1lidas e inv\u00e1lidas al hacer zapping/anular la asignaci\u00f3n de un rango gfn, ya que KVM debe asegurarse de que no contiene referencias a la p\u00e1gina liberada despu\u00e9s de regresar de la operaci\u00f3n de anulaci\u00f3n de la asignaci\u00f3n. En particular, TDP MMU no elimina las ra\u00edces inv\u00e1lidas en las devoluciones de llamadas mmu_notifier. Esto conduce a problemas de use-after-free y otros problemas si mmu_notifier se ejecuta hasta el final mientras que un zapper de ra\u00edz inv\u00e1lida cede, ya que KVM no cumple con el requisito de que no debe haber _ninguna_ referencia a la p\u00e1gina despu\u00e9s de que mmu_notifier regrese. El error se reproduce m\u00e1s f\u00e1cilmente pirateando KVM para provocar una colisi\u00f3n entre set_nx_huge_pages() y kvm_mmu_notifier_release(), pero el error tambi\u00e9n existe entre kvm_mmu_notifier_invalidate_range_start() y las actualizaciones de memslot. Invalidar una ra\u00edz garantiza que el invitado no pueda acceder a las p\u00e1ginas, y KVM no leer\u00e1 ni escribir\u00e1 datos de p\u00e1gina por s\u00ed mismo, pero KVM activar\u00e1, por ejemplo, kvm_set_pfn_dirty() al hacer zapping de SPTE, y por lo tanto, completar un zapping de una ra\u00edz no v\u00e1lida _despu\u00e9s_ de que mmu_notifier regrese es fatal. ADVERTENCIA: CPU: 24 PID: 1496 en arch/x86/kvm/../../../virt/kvm/kvm_main.c:173 [kvm] RIP: 0010:kvm_is_zone_device_pfn+0x96/0xa0 [kvm] Rastreo de llamadas:  kvm_set_pfn_dirty+0xa8/0xe0 [kvm] __handle_changed_spte+0x2ab/0x5e0 [kvm] __handle_changed_spte+0x2ab/0x5e0 [kvm] __handle_changed_spte+0x2ab/0x5e0 [kvm] zap_gfn_range+0x1f3/0x310 [kvm] kvm_tdp_mmu_zap_ra\u00edces_invalidadas+0x50/0x90 [kvm] kvm_mmu_zap_all_fast+0x177/0x1a0 [kvm] set_nx_huge_pages+0xb4/0x190 [kvm] param_attr_store+0x70/0x100 module_attr_store+0x19/0x30 kernfs_fop_write_iter+0x119/0x1b0 new_sync_write+0x11c/0x1b0 vfs_write+0x1cc/0x270 ksys_write+0x5f/0xe0 do_syscall_64+0x38/0xc0 entry_SYSCALL_64_after_hwframe+0x44/0xae \"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.13\",\"versionEndExcluding\":\"5.15.33\",\"matchCriteriaId\":\"3635E21D-6C8E-41E4-BF98-89A503BAF23D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"5.16.19\",\"matchCriteriaId\":\"20C43679-0439-405A-B97F-685BEE50613B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.17\",\"versionEndExcluding\":\"5.17.2\",\"matchCriteriaId\":\"210C679C-CF84-44A3-8939-E629C87E54BF\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0c8a8da182d4333d9bbb9131d765145568c847b2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8cf6f98ab1d16d5e607635a0c21c4231eb15367e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/af47248407c0c5ae52a752af1ab5ce5b0db91502\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d62007edf01f5c11f75d0f4b1e538fc52a5b1982\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-02-26T01:54:11.651Z\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nKVM: x86/mmu: Zap _all_ roots when unmapping gfn range in TDP MMU\\n\\nZap both valid and invalid roots when zapping/unmapping a gfn range, as\\nKVM must ensure it holds no references to the freed page after returning\\nfrom the unmap operation.  Most notably, the TDP MMU doesn\u0027t zap invalid\\nroots in mmu_notifier callbacks.  This leads to use-after-free and other\\nissues if the mmu_notifier runs to completion while an invalid root\\nzapper yields as KVM fails to honor the requirement that there must be\\n_no_ references to the page after the mmu_notifier returns.\\n\\nThe bug is most easily reproduced by hacking KVM to cause a collision\\nbetween set_nx_huge_pages() and kvm_mmu_notifier_release(), but the bug\\nexists between kvm_mmu_notifier_invalidate_range_start() and memslot\\nupdates as well.  Invalidating a root ensures pages aren\u0027t accessible by\\nthe guest, and KVM won\u0027t read or write page data itself, but KVM will\\ntrigger e.g. kvm_set_pfn_dirty() when zapping SPTEs, and thus completing\\na zap of an invalid root _after_ the mmu_notifier returns is fatal.\\n\\n  WARNING: CPU: 24 PID: 1496 at arch/x86/kvm/../../../virt/kvm/kvm_main.c:173 [kvm]\\n  RIP: 0010:kvm_is_zone_device_pfn+0x96/0xa0 [kvm]\\n  Call Trace:\\n   \u003cTASK\u003e\\n   kvm_set_pfn_dirty+0xa8/0xe0 [kvm]\\n   __handle_changed_spte+0x2ab/0x5e0 [kvm]\\n   __handle_changed_spte+0x2ab/0x5e0 [kvm]\\n   __handle_changed_spte+0x2ab/0x5e0 [kvm]\\n   zap_gfn_range+0x1f3/0x310 [kvm]\\n   kvm_tdp_mmu_zap_invalidated_roots+0x50/0x90 [kvm]\\n   kvm_mmu_zap_all_fast+0x177/0x1a0 [kvm]\\n   set_nx_huge_pages+0xb4/0x190 [kvm]\\n   param_attr_store+0x70/0x100\\n   module_attr_store+0x19/0x30\\n   kernfs_fop_write_iter+0x119/0x1b0\\n   new_sync_write+0x11c/0x1b0\\n   vfs_write+0x1cc/0x270\\n   ksys_write+0x5f/0xe0\\n   do_syscall_64+0x38/0xc0\\n   entry_SYSCALL_64_after_hwframe+0x44/0xae\\n   \u003c/TASK\u003e\"}], \"affected\": [{\"product\": \"Linux\", \"vendor\": \"Linux\", \"defaultStatus\": \"unaffected\", \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"programFiles\": [\"arch/x86/kvm/mmu/tdp_mmu.c\"], \"versions\": [{\"version\": \"b7cccd397f310739fb85383033e95580f99927e0\", \"lessThan\": \"af47248407c0c5ae52a752af1ab5ce5b0db91502\", \"status\": \"affected\", \"versionType\": \"git\"}, {\"version\": \"b7cccd397f310739fb85383033e95580f99927e0\", \"lessThan\": \"0c8a8da182d4333d9bbb9131d765145568c847b2\", \"status\": \"affected\", \"versionType\": \"git\"}, {\"version\": \"b7cccd397f310739fb85383033e95580f99927e0\", \"lessThan\": \"8cf6f98ab1d16d5e607635a0c21c4231eb15367e\", \"status\": \"affected\", \"versionType\": \"git\"}, {\"version\": \"b7cccd397f310739fb85383033e95580f99927e0\", \"lessThan\": \"d62007edf01f5c11f75d0f4b1e538fc52a5b1982\", \"status\": \"affected\", \"versionType\": \"git\"}]}, {\"product\": \"Linux\", \"vendor\": \"Linux\", \"defaultStatus\": \"affected\", \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"programFiles\": [\"arch/x86/kvm/mmu/tdp_mmu.c\"], \"versions\": [{\"version\": \"5.13\", \"status\": \"affected\"}, {\"version\": \"0\", \"lessThan\": \"5.13\", \"status\": \"unaffected\", \"versionType\": \"semver\"}, {\"version\": \"5.15.33\", \"lessThanOrEqual\": \"5.15.*\", \"status\": \"unaffected\", \"versionType\": \"semver\"}, {\"version\": \"5.16.19\", \"lessThanOrEqual\": \"5.16.*\", \"status\": \"unaffected\", \"versionType\": \"semver\"}, {\"version\": \"5.17.2\", \"lessThanOrEqual\": \"5.17.*\", \"status\": \"unaffected\", \"versionType\": \"semver\"}, {\"version\": \"5.18\", \"lessThanOrEqual\": \"*\", \"status\": \"unaffected\", \"versionType\": \"original_commit_for_fix\"}]}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/af47248407c0c5ae52a752af1ab5ce5b0db91502\"}, {\"url\": \"https://git.kernel.org/stable/c/0c8a8da182d4333d9bbb9131d765145568c847b2\"}, {\"url\": \"https://git.kernel.org/stable/c/8cf6f98ab1d16d5e607635a0c21c4231eb15367e\"}, {\"url\": \"https://git.kernel.org/stable/c/d62007edf01f5c11f75d0f4b1e538fc52a5b1982\"}], \"title\": \"KVM: x86/mmu: Zap _all_ roots when unmapping gfn range in TDP MMU\", \"x_generator\": {\"engine\": \"bippy-5f407fcff5a0\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-47639\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-02-27T18:17:52.744634Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-02-27T18:17:54.139Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2021-47639\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"Linux\", \"dateReserved\": \"2025-02-26T01:48:21.519Z\", \"datePublished\": \"2025-02-26T01:54:11.651Z\", \"dateUpdated\": \"2025-02-27T18:22:35.903Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.