CVE-2021-47390
📋 TL;DR
This CVE describes a stack-based buffer overflow vulnerability in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem. The flaw occurs when the ioapic_write_indirect() function incorrectly allocates a vcpu_bitmap on the stack, allowing attackers to read kernel stack memory. This affects systems running Linux with KVM virtualization enabled.
💻 Affected Systems
- Linux kernel with KVM virtualization
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Information disclosure of kernel stack memory could lead to privilege escalation or kernel crash, potentially allowing attackers to gain root access or cause denial of service.
Likely Case
Information disclosure of kernel memory, potentially exposing sensitive data or causing system instability.
If Mitigated
Limited impact with proper access controls and virtualization isolation, though information disclosure risk remains.
🎯 Exploit Status
Requires local access to the host system or ability to run code in a guest VM. The vulnerability is a read-only memory disclosure, not a write vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in Linux kernel commits: 2f9b68f57c6278c322793a06063181deded0ad69, 99a9e9b80f19fc63be005a33d76211dd23114792, bebabb76ad9acca8858e0371e102fb60d708e25b
Vendor Advisory: https://git.kernel.org/stable/c/2f9b68f57c6278c322793a06063181deded0ad69
Restart Required: Yes
Instructions:
1. Update Linux kernel to version containing the fix commits. 2. Check your distribution's security advisories for specific patched kernel versions. 3. Reboot the system after kernel update.
🔧 Temporary Workarounds
Disable KVM virtualization
linuxDisable KVM module loading to prevent exploitation
echo 'blacklist kvm' >> /etc/modprobe.d/blacklist.conf
rmmod kvm
🧯 If You Can't Patch
- Restrict access to virtualization hosts to trusted users only
- Implement strict VM isolation and monitor for unusual guest behavior
🔍 How to Verify
Check if Vulnerable:
Check kernel version and verify if KVM module is loaded: lsmod | grep kvmCheck Version:
uname -rVerify Fix Applied:
Verify kernel version includes the fix commits or check with your distribution's security advisory📡 Detection & Monitoring
Log Indicators:
- Kernel panic logs
- KASAN reports of stack-out-of-bounds access
- System crashes related to KVM
Network Indicators:
- None - this is a local vulnerability
SIEM Query:
Search for kernel logs containing 'KASAN: stack-out-of-bounds' or 'ioapic_write_indirect' errors🔗 References
- https://git.kernel.org/stable/c/2f9b68f57c6278c322793a06063181deded0ad69
- https://git.kernel.org/stable/c/99a9e9b80f19fc63be005a33d76211dd23114792
- https://git.kernel.org/stable/c/bebabb76ad9acca8858e0371e102fb60d708e25b
- https://git.kernel.org/stable/c/2f9b68f57c6278c322793a06063181deded0ad69
- https://git.kernel.org/stable/c/99a9e9b80f19fc63be005a33d76211dd23114792
- https://git.kernel.org/stable/c/bebabb76ad9acca8858e0371e102fb60d708e25b
