Bug 1965461 (CVE-2021-22543)
Summary: | CVE-2021-22543 kernel: Improper handling of VM_IO|VM_PFNMAP vmas in KVM can bypass RO checks | ||
---|---|---|---|
Product: | [Other] Security Response | Reporter: | Pedro Sampaio <psampaio> |
Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
Status: | CLOSED ERRATA | QA Contact: | |
Severity: | high | Docs Contact: | |
Priority: | high | ||
Version: | unspecified | CC: | acaringi, adscvr, airlied, alciregi, asavkov, bhu, blc, bmasney, brdeoliv, bskeggs, chwhite, crwood, dblechte, dfediuck, dhoward, dvlasenk, eedri, fhrbata, fpacheco, hdegoede, hkrzesin, jarodwilson, jeremy, jforbes, jglisse, jlelli, joe.lawrence, jonathan, josef, jpoimboe, jshortt, jstancek, jthierry, jwboyer, kcarcia, kernel-maint, kernel-mgr, kpatch-maint, lgoncalv, linville, masami256, mchehab, mgoldboi, michal.skrivanek, mlangsdo, mvanderw, nmurray, nobody, ptalbert, qzhao, rhandlin, rvrbovsk, sbonazzo, sherold, steved, walters, wcosta, williams, ycote, yturgema, zhilli |
Target Milestone: | --- | Keywords: | Security |
Target Release: | --- | ||
Hardware: | All | ||
OS: | Linux | ||
Whiteboard: | |||
Fixed In Version: | kernel 5.13 | Doc Type: | If docs needed, set a value |
Doc Text: |
A flaw was found in the Linux kernel’s KVM implementation, where improper handing of the VM_IO|VM_PFNMAP VMAs in KVM bypasses RO checks and leads to pages being freed while still accessible by the VMM and guest. This flaw allows users who can start and control a VM to read/write random pages of memory, resulting in local privilege escalation. The highest threat from this vulnerability is to confidentiality, integrity, and system availability.
|
Story Points: | --- |
Clone Of: | Environment: | ||
Last Closed: | 2021-08-10 13:28:48 UTC | Type: | --- |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: | |||
Bug Depends On: | 1973088, 1965462, 1973042, 1973043, 1973044, 1973049, 1973050, 1973051, 1973089, 1973090, 1973091, 1975511, 1975512, 1975513, 1975514, 1975515, 1975516, 1975517, 1975748, 1975750, 1975751, 1975752, 1975753, 1975754, 1975755, 1975756, 1975757, 1975758, 1975759, 1975760, 1975761, 1975762, 1975764, 1975765, 1975766, 1975793, 1975794, 1994422 | ||
Bug Blocks: | 1965463 |
Description
Pedro Sampaio
2021-05-27 18:19:53 UTC
Created kernel tracking bugs for this issue: Affects: fedora-all [bug 1965462] Upstream fix aiming to address the first PoC from google advisory (vvar_write.c): https://github.com/torvalds/linux/commit/bd2fae8d https://github.com/torvalds/linux/commit/a9545779 Note that the second PoC (kernel_write.c) is still being worked on, see https://seclists.org/oss-sec/2021/q2/169. This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2021:3044 https://access.redhat.com/errata/RHSA-2021:3044 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2021:3088 https://access.redhat.com/errata/RHSA-2021:3088 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2021:3057 https://access.redhat.com/errata/RHSA-2021:3057 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2021-22543 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.1 Extended Update Support Via RHSA-2021:3173 https://access.redhat.com/errata/RHSA-2021:3173 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.1 Extended Update Support Via RHSA-2021:3181 https://access.redhat.com/errata/RHSA-2021:3181 This issue has been addressed in the following products: Red Hat Virtualization 4 for Red Hat Enterprise Linux 8 Via RHSA-2021:3235 https://access.redhat.com/errata/RHSA-2021:3235 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.2 Extended Update Support Via RHSA-2021:3375 https://access.redhat.com/errata/RHSA-2021:3375 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.2 Extended Update Support Via RHSA-2021:3380 https://access.redhat.com/errata/RHSA-2021:3380 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.2 Extended Update Support Via RHSA-2021:3363 https://access.redhat.com/errata/RHSA-2021:3363 This issue has been addressed in the following products: Red Hat Enterprise Linux 7.4 Advanced Update Support Via RHSA-2021:3725 https://access.redhat.com/errata/RHSA-2021:3725 This issue has been addressed in the following products: Red Hat Enterprise Linux 7.2 Advanced Update Support Via RHSA-2021:81932 https://access.redhat.com/errata/RHSA-2021:81932 This issue has been addressed in the following products: Red Hat Enterprise Linux 7.3 Advanced Update Support Via RHSA-2021:3766 https://access.redhat.com/errata/RHSA-2021:3766 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2021:3768 https://access.redhat.com/errata/RHSA-2021:3768 This issue has been addressed in the following products: Red Hat Enterprise Linux 7.6 Advanced Update Support Red Hat Enterprise Linux 7.6 Update Services for SAP Solutions Red Hat Enterprise Linux 7.6 Telco Extended Update Support Via RHSA-2021:3812 https://access.redhat.com/errata/RHSA-2021:3812 This issue has been addressed in the following products: Red Hat Enterprise Linux 7.6 Update Services for SAP Solutions Via RHSA-2021:3814 https://access.redhat.com/errata/RHSA-2021:3814 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2021:3801 https://access.redhat.com/errata/RHSA-2021:3801 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2021:3802 https://access.redhat.com/errata/RHSA-2021:3802 This issue has been addressed in the following products: Red Hat Virtualization 4 for Red Hat Enterprise Linux 7 Via RHSA-2021:3943 https://access.redhat.com/errata/RHSA-2021:3943 This issue has been addressed in the following products: Red Hat Enterprise Linux 7.7 Advanced Update Support Red Hat Enterprise Linux 7.7 Update Services for SAP Solutions Red Hat Enterprise Linux 7.7 Telco Extended Update Support Via RHSA-2021:3987 https://access.redhat.com/errata/RHSA-2021:3987 This issue has been addressed in the following products: Red Hat Enterprise Linux 7.7 Update Services for SAP Solutions Via RHSA-2021:4000 https://access.redhat.com/errata/RHSA-2021:4000 This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Extended Lifecycle Support Via RHSA-2022:5640 https://access.redhat.com/errata/RHSA-2022:5640 |