CVE-2021-47277 – This CVE describes a speculative execution vuln... (How to Fix)

Q: What is the severity of CVE-2021-47277?

CVE-2021-47277 has a CVSS score of 7.1 (HIGH). This CVE describes a speculative execution vulnerability in the Linux kernel's KVM hypervisor where a malicious guest VM could potentially read host kernel memory through out-of-bounds memory slot accesses. The vulnerability affects systems running KVM virtualization with untrusted guest VMs. This is a speculative execution attack similar to Spectre variants.

📋 TL;DR

This CVE describes a speculative execution vulnerability in the Linux kernel's KVM hypervisor where a malicious guest VM could potentially read host kernel memory through out-of-bounds memory slot accesses. The vulnerability affects systems running KVM virtualization with untrusted guest VMs. This is a speculative execution attack similar to Spectre variants.

💻 Affected Systems

Products:

Linux kernel with KVM virtualization

Versions: Linux kernel versions before the fix commits (specific versions vary by distribution)

Operating Systems: Linux distributions with KVM support

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems using KVM virtualization with untrusted guest VMs. ARM architectures may be more susceptible than x86 due to different memory access implementations.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Guest VM could read sensitive host kernel memory, potentially exposing credentials, encryption keys, or other protected data from the host system.

🟠

Likely Case

Limited information disclosure from host kernel memory to untrusted guest VMs, though exploitation requires specific conditions and gadget chains.

🟢

If Mitigated

Minimal impact with proper patching as the fix prevents speculative execution from using invalid guest frame numbers.

🌐 Internet-Facing: LOW - This requires local guest VM access, not direct internet exposure.

🏢 Internal Only: MEDIUM - Affects virtualization hosts running untrusted guest VMs in multi-tenant environments.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: HIGH

Exploitation requires building data-dependent access gadget chains and specific CPU speculative execution conditions. No known public exploits exist.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Linux kernel with commits 22b87fb17a28d, 3098b86390a6b, 361ce3b917aff, 740621309b25b, or 7af299b97734c (depending on kernel version)

Vendor Advisory: https://git.kernel.org/stable/c/22b87fb17a28d37331bb9c1110737627b17f6781

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution. 2. Reboot the host system. 3. Verify kernel version after reboot.

🔧 Temporary Workarounds

Disable KVM if not needed

linux

Remove KVM module if virtualization is not required

sudo modprobe -r kvm
sudo modprobe -r kvm_intel (or kvm_amd)

Restrict untrusted guest VMs

all

Only run trusted guest VMs until patched

🧯 If You Can't Patch

Isolate virtualization hosts from sensitive networks
Implement strict access controls and monitoring for guest VMs

🔍 How to Verify

Check if Vulnerable:

Check if running a vulnerable kernel version and KVM is loaded: 'lsmod | grep kvm' and 'uname -r'

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is patched and contains the fix commits: 'uname -r' and check kernel changelog

📡 Detection & Monitoring

Log Indicators:

Kernel oops or crashes related to memory access
Unusual guest VM behavior attempting invalid memory accesses

Network Indicators:

Not network exploitable - local vulnerability only

SIEM Query:

Search for kernel panic logs or KVM module errors in system logs

📊 Metadata

CVE ID: CVE-2021-47277

CVSS v3 Score: 7.1 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE: CWE-125

Published: May 21, 2024

Last Updated: April 30, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2021-47277, you might also want to check these: