Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
615
VMScore

CVE-2021-29657

Published: 22/07/2021 Updated: 19/05/2023
CVSS v2 Base Score: 6.9 | Impact Score: 10 | Exploitability Score: 3.4
CVSS v3 Base Score: 7.4 | Impact Score: 5.9 | Exploitability Score: 1.4
VMScore: 615
Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C
Subscribe to Linux

Vulnerability Summary

arch/x86/kvm/svm/nested.c in the Linux kernel prior to 5.11.12 has a use-after-free in which an AMD KVM guest can bypass access control on host OS MSRs when there are nested guests, aka CID-a58d9166a756. This occurs because of a TOCTOU race condition associated with a VMCB12 double fetch in nested_svm_vmrun.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

linux linux kernel

Vendor Advisories

Arch Linux Issues:
A security issue was found in the Linux kernel There is a race condition between check and use of the nested VMCB controls in KVM ...

References

CWE-416CWE-367https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a58d9166a756a0f4a6618e4f593232593d6df134https://bugs.chromium.org/p/project-zero/issues/detail?id=2177https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.11.12http://packetstormsecurity.com/files/163324/KVM-nested_svm_vmrun-Double-Fetch.htmlhttps://security.netapp.com/advisory/ntap-20210902-0008/https://nvd.nist.govhttps://security.archlinux.org/CVE-2021-29657
VMScore
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2020-4463CVE-2024-3400deserializationCVE-2024-21788CVE-2023-42433CVE-2024-21841CVE-2024-22095local file inclusionmemory leak
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook