Vulnerability · Published Jul 22, 2021 · Assigned by mitre
CVE-2021-29657
High 7.4
In plain English
A high-severity security flaw in the linux package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.4High
Exploit odds (30 days)0.4%top 63.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
arch/x86/kvm/svm/nested.c in the Linux kernel before 5.11.12 has a use-after-free in which an AMD KVM guest can bypass access control on host OS MSRs when there are nested guests, aka CID-a58d9166a756. This occurs because of a TOCTOU race condition associated with a VMCB12 double fetch in nested_svm_vmrun.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | linux | 5.10.28-1 | DEBIAN-CVE-2021-29657 |
| Debian:13 | linux | 5.10.28-1 | DEBIAN-CVE-2021-29657 |
| Debian:14 | linux | 5.10.28-1 | DEBIAN-CVE-2021-29657 |
Affected products (as reported)
References
- http://packetstormsecurity.com/files/163324/KVM-nested_svm_vmrun-Double-Fetch.html x_refsource_MISC
- https://bugs.chromium.org/p/project-zero/issues/detail?id=2177 x_refsource_MISC
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a58d9166a756a0f4a6618e4f593232593d6df134 x_refsource_CONFIRM
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.11.12 x_refsource_CONFIRM
- https://security.netapp.com/advisory/ntap-20210902-0008/ x_refsource_CONFIRM