Bug 1220606 (CVE-2021-46977) - VUL-0: CVE-2021-46977: kernel: KVM: VMX: MSR corruption via preemption when probing user return MSRs
Summary: VUL-0: CVE-2021-46977: kernel: KVM: VMX: MSR corruption via preemption when p...
Status: RESOLVED FIXED
Alias: CVE-2021-46977
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P5 - None : Normal
Target Milestone: ---
Assignee: Kernel Bugs
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/395426/
Whiteboard: CVSSv3.1:SUSE:CVE-2021-46977:4.7:(AV:...
Keywords:
Depends on:
Blocks:
 
Reported: 2024-02-29 08:25 UTC by SMASH SMASH
Modified: 2024-02-29 08:25 UTC (History)
1 user (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description SMASH SMASH 2024-02-29 08:25:01 UTC 
In the Linux kernel, the following vulnerability has been resolved:

KVM: VMX: Disable preemption when probing user return MSRs

Disable preemption when probing a user return MSR via RDSMR/WRMSR.  If
the MSR holds a different value per logical CPU, the WRMSR could corrupt
the host's value if KVM is preempted between the RDMSR and WRMSR, and
then rescheduled on a different CPU.

Opportunistically land the helper in common x86, SVM will use the helper
in a future commit.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-46977
https://www.cve.org/CVERecord?id=CVE-2021-46977
https://git.kernel.org/stable/c/31f29749ee970c251b3a7e5b914108425940d089
https://git.kernel.org/stable/c/5104d7ffcf24749939bea7fdb5378d186473f890
https://git.kernel.org/stable/c/5adcdeb57007ccf8ab7ac20bf787ffb6fafb1a94
https://git.kernel.org/stable/c/e3ea1895df719c4ef87862501bb10d95f4177bed
Comment 1 Carlos López 2024-02-29 08:25:43 UTC 
Already fixed in affected branches (cve/linux-5.14, SLE15-SP6, stable and master). Closing.