7.1

CVE-2021-47110

x86/kvm: Disable kvmclock on all CPUs on shutdown

In the Linux kernel, the following vulnerability has been resolved:

x86/kvm: Disable kvmclock on all CPUs on shutdown

Currenly, we disable kvmclock from machine_shutdown() hook and this
only happens for boot CPU. We need to disable it for all CPUs to
guard against memory corruption e.g. on restore from hibernate.

Note, writing '0' to kvmclock MSR doesn't clear memory location, it
just prevents hypervisor from updating the location so for the short
while after write and while CPU is still alive, the clock remains usable
and correct so we don't need to switch to some other clocksource.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
LinuxLinux Kernel Version < 5.4.125
LinuxLinux Kernel Version >= 5.5 < 5.10.43
LinuxLinux Kernel Version >= 5.11 < 5.12.10
LinuxLinux Kernel Version5.13 Updaterc1
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.25% 0.154
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.1 1.8 5.2
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CWE-459 Incomplete Cleanup

The product does not properly "clean up" and remove temporary or supporting resources after they have been used.

https://git.kernel.org/stable/c/1df2dc09926f61319116c80ee85701df33577d70
Patch
https://git.kernel.org/stable/c/3b0becf8b1ecf642a9edaf4c9628ffc641e490d6
Patch
https://git.kernel.org/stable/c/9084fe1b3572664ad276f427dce575f580c9799a
Patch
https://git.kernel.org/stable/c/c02027b5742b5aa804ef08a4a9db433295533046
Patch