NetSight
IP …
high8.8

CVE-2021-3656

A flaw was found in the KVM's AMD code for supporting SVM nested virtualization.

Impact

A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMCB (virtual machine control block) provided by the L1 guest to spawn/handle a nested guest (L2). Due to improper validation of the "virt_ext" field, this issue could allow a malicious L1 to disable both VMLOAD/VMSAVE intercepts and VLS (Virtual VMLOAD/VMSAVE) for the L2 guest. As a result, the L2 guest would be allowed to read/write physical pages of the host, resulting in a crash of the entire system, leak of sensitive data or potential guest-to-host escape.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 4.13 before 4.14.245
from 4.15 before 4.19.205
from 4.20 before 5.4.142
from 5.5 before 5.10.60
from 5.11 before 5.13.12
Version 5.14
FedoraprojectFedora
Versions 33, 34
RedhatSoftware Collections
All versions
RedhatOpenstack
Version 13
RedhatEnterprise Linux
Version 8.0
RedhatEnterprise Linux Desktop
Version 7.0
RedhatEnterprise Linux Eus
Versions 8.1, 8.2, 8.4
RedhatEnterprise Linux For Ibm Z Systems
Versions 7.0, 8.0
RedhatEnterprise Linux For Ibm Z Systems Eus
Versions 8.1, 8.2, 8.4
RedhatEnterprise Linux For Power Big Endian
Version 7.0
RedhatEnterprise Linux For Power Little Endian
Versions 7.0, 8.0
RedhatEnterprise Linux For Power Little Endian Eus
Versions 8.1, 8.2, 8.4

Weakness classification

CWE-862

References