A flaw was found in the Linux kernel. The value of internal.ndata, in the KVM API, is mapped to an array index, which can be updated by a user process at anytime which could lead to an out-of-bounds write. The highest threat from this vulnerability is to data integrity and system availability. __vmx_handle_exit() uses vcpu->run->internal.ndata, whose value is mapped to an array index and since vcpu->run can be updated in userspace, it allows a out-of-bounds write. Reference and upstream patch: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=04c4f2ee3f68c9a4bf1653d15f1a9a435ae33f7a
Statement: This issue affected Linux kernel versions as shipped with Red Hat Enterprise Linux 8 starting with RHEL-8.4.0 and onward kernel version.
Mitigation: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
External References: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=04c4f2ee3f68c9a4bf1653d15f1a9a435ae33f7a
Created kernel tracking bugs for this issue: Affects: fedora-all [bug 1954240]
Created kernel tracking bugs for this issue: Affects: fedora-all [bug 1954241]
This was fixed for Fedora with the 5.11.16 stable kernel updates.
Acknowledgments: Name: Reiji Watanabe (Google)
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2021:2169 https://access.redhat.com/errata/RHSA-2021:2169
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2021:2165 https://access.redhat.com/errata/RHSA-2021:2165
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2021:2168 https://access.redhat.com/errata/RHSA-2021:2168
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2021-3501
This issue has been addressed in the following products: Red Hat Virtualization 4 for Red Hat Enterprise Linux 8 Via RHSA-2021:2522 https://access.redhat.com/errata/RHSA-2021:2522