CVE-2021-47112 (GCVE-0-2021-47112)

Vulnerability from cvelistv5 – Published: 2024-03-15 20:14 – Updated: 2026-08-05 08:46
VLAI
Title
x86/kvm: Teardown PV features on boot CPU as well
Summary
In the Linux kernel, the following vulnerability has been resolved: x86/kvm: Teardown PV features on boot CPU as well Various PV features (Async PF, PV EOI, steal time) work through memory shared with hypervisor and when we restore from hibernation we must properly teardown all these features to make sure hypervisor doesn't write to stale locations after we jump to the previously hibernated kernel (which can try to place anything there). For secondary CPUs the job is already done by kvm_cpu_down_prepare(), register syscore ops to do the same for boot CPU.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: fd10cde9294f73eeccbc16f3fec1ae6cde7b800c , < 7620a669111b52f224d006dea9e1e688e2d62c54 (git)
Affected: fd10cde9294f73eeccbc16f3fec1ae6cde7b800c , < 38b858da1c58ad46519a257764e059e663b59ff2 (git)
Affected: fd10cde9294f73eeccbc16f3fec1ae6cde7b800c , < d1629b5b925de9b27979e929dae7fcb766daf6b6 (git)
Affected: fd10cde9294f73eeccbc16f3fec1ae6cde7b800c , < 8b79feffeca28c5459458fe78676b081e87c93a4 (git)
Create a notification for this product.
Linux Linux Affected: 2.6.38
Unaffected: 0 , < 2.6.38 (semver)
Unaffected: 5.4.125 , ≤ 5.4.* (semver)
Unaffected: 5.10.43 , ≤ 5.10.* (semver)
Unaffected: 5.12.10 , ≤ 5.12.* (semver)
Unaffected: 5.13 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47112",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-18T20:26:26.037473Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:14:29.430Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:24:39.829Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/7620a669111b52f224d006dea9e1e688e2d62c54"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/38b858da1c58ad46519a257764e059e663b59ff2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d1629b5b925de9b27979e929dae7fcb766daf6b6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8b79feffeca28c5459458fe78676b081e87c93a4"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kernel/kvm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7620a669111b52f224d006dea9e1e688e2d62c54",
              "status": "affected",
              "version": "fd10cde9294f73eeccbc16f3fec1ae6cde7b800c",
              "versionType": "git"
            },
            {
              "lessThan": "38b858da1c58ad46519a257764e059e663b59ff2",
              "status": "affected",
              "version": "fd10cde9294f73eeccbc16f3fec1ae6cde7b800c",
              "versionType": "git"
            },
            {
              "lessThan": "d1629b5b925de9b27979e929dae7fcb766daf6b6",
              "status": "affected",
              "version": "fd10cde9294f73eeccbc16f3fec1ae6cde7b800c",
              "versionType": "git"
            },
            {
              "lessThan": "8b79feffeca28c5459458fe78676b081e87c93a4",
              "status": "affected",
              "version": "fd10cde9294f73eeccbc16f3fec1ae6cde7b800c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kernel/kvm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.38"
            },
            {
              "lessThan": "2.6.38",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.125",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.43",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.12.*",
              "status": "unaffected",
              "version": "5.12.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.125",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.43",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.12.10",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.13",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/kvm: Teardown PV features on boot CPU as well\n\nVarious PV features (Async PF, PV EOI, steal time) work through memory\nshared with hypervisor and when we restore from hibernation we must\nproperly teardown all these features to make sure hypervisor doesn\u0027t\nwrite to stale locations after we jump to the previously hibernated kernel\n(which can try to place anything there). For secondary CPUs the job is\nalready done by kvm_cpu_down_prepare(), register syscore ops to do\nthe same for boot CPU."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is in guest-side KVM paravirt code (arch/x86/kernel/kvm.c) and is reached only when the guest performs local hibernation/suspend-to-disk (write to /sys/power/state or logind), not via network packets or adjacent-link protocols.\nAC:L - On a KVM guest with PV features (steal time/PV EOI/async PF), initiating hibernate/resume cycles deterministically leaves boot-CPU PV MSRs enabled so the hypervisor keeps writing shared structures; Ubuntu reproduced reliable memory corruption after repeated hibernate/resume with no attacker-uncontrollable race.\nPR:L - An active local seat user can trigger hibernate/suspend through logind/polkit without real init-namespace root, matching the worst reasonable desktop/laptop KVM-guest deployment; this does not require capabilities obtainable only outside user namespaces.\nUI:N - The attacker initiates hibernation/resume themselves (or the same path is entered by session autosleep); no separate victim action such as mounting a filesystem or opening a crafted file is required.\nS:U - Impact is memory corruption inside the guest kernel from incomplete PV teardown; this is not a guest-to-host escape, IOMMU bypass, or other cross-authority breakout (the host already fully controls guest memory).\nC:H - Hypervisor writes into stale guest GPAs after resume corrupt arbitrary kernel pages that reused those locations (observed page-flag corruption); such kernel memory corruption can be leveraged for information disclosure.\nI:H - The same stale-GPA writes are kernel memory corruption (page metadata and whatever structures land at the still-registered GPAs), which is exploitable for integrity break / control-flow hijacking under the higher-severity memory-corruption guidance.\nA:H - The corruption manifests as BUG: Bad page state / page-allocator failures and can oops/panic or otherwise crash the guest kernel after hibernation resume, fully denying availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:46:05.685Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7620a669111b52f224d006dea9e1e688e2d62c54"
        },
        {
          "url": "https://git.kernel.org/stable/c/38b858da1c58ad46519a257764e059e663b59ff2"
        },
        {
          "url": "https://git.kernel.org/stable/c/d1629b5b925de9b27979e929dae7fcb766daf6b6"
        },
        {
          "url": "https://git.kernel.org/stable/c/8b79feffeca28c5459458fe78676b081e87c93a4"
        }
      ],
      "title": "x86/kvm: Teardown PV features on boot CPU as well",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47112",
    "datePublished": "2024-03-15T20:14:20.602Z",
    "dateReserved": "2024-03-04T18:12:48.836Z",
    "dateUpdated": "2026-08-05T08:46:05.685Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-47112",
      "date": "2026-08-10",
      "epss": "0.00247",
      "percentile": "0.15978"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nx86/kvm: Teardown PV features on boot CPU as well\\n\\nVarious PV features (Async PF, PV EOI, steal time) work through memory\\nshared with hypervisor and when we restore from hibernation we must\\nproperly teardown all these features to make sure hypervisor doesn\u0027t\\nwrite to stale locations after we jump to the previously hibernated kernel\\n(which can try to place anything there). For secondary CPUs the job is\\nalready done by kvm_cpu_down_prepare(), register syscore ops to do\\nthe same for boot CPU.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: x86/kvm: Desmontaje de funciones PV tambi\\u00e9n en la CPU de arranque Varias funciones PV (Async PF, PV EOI, tiempo de robo) funcionan a trav\\u00e9s de la memoria compartida con el hipervisor y cuando restauramos desde la hibernaci\\u00f3n Debemos eliminar adecuadamente todas estas caracter\\u00edsticas para asegurarnos de que el hipervisor no escriba en ubicaciones obsoletas despu\\u00e9s de saltar al kernel previamente hibernado (que puede intentar colocar cualquier cosa all\\u00ed). Para las CPU secundarias, el trabajo ya lo realiza kvm_cpu_down_prepare(), registre syscore ops para hacer lo mismo para la CPU de arranque.\"}]",
      "id": "CVE-2021-47112",
      "lastModified": "2024-11-21T06:35:25.327",
      "published": "2024-03-15T21:15:06.627",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/38b858da1c58ad46519a257764e059e663b59ff2\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/7620a669111b52f224d006dea9e1e688e2d62c54\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/8b79feffeca28c5459458fe78676b081e87c93a4\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/d1629b5b925de9b27979e929dae7fcb766daf6b6\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/38b858da1c58ad46519a257764e059e663b59ff2\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/7620a669111b52f224d006dea9e1e688e2d62c54\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/8b79feffeca28c5459458fe78676b081e87c93a4\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/d1629b5b925de9b27979e929dae7fcb766daf6b6\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-47112\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-03-15T21:15:06.627\",\"lastModified\":\"2026-08-04T10:16:46.597\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nx86/kvm: Teardown PV features on boot CPU as well\\n\\nVarious PV features (Async PF, PV EOI, steal time) work through memory\\nshared with hypervisor and when we restore from hibernation we must\\nproperly teardown all these features to make sure hypervisor doesn\u0027t\\nwrite to stale locations after we jump to the previously hibernated kernel\\n(which can try to place anything there). For secondary CPUs the job is\\nalready done by kvm_cpu_down_prepare(), register syscore ops to do\\nthe same for boot CPU.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: x86/kvm: Desmontaje de funciones PV tambi\u00e9n en la CPU de arranque Varias funciones PV (Async PF, PV EOI, tiempo de robo) funcionan a trav\u00e9s de la memoria compartida con el hipervisor y cuando restauramos desde la hibernaci\u00f3n Debemos eliminar adecuadamente todas estas caracter\u00edsticas para asegurarnos de que el hipervisor no escriba en ubicaciones obsoletas despu\u00e9s de saltar al kernel previamente hibernado (que puede intentar colocar cualquier cosa all\u00ed). Para las CPU secundarias, el trabajo ya lo realiza kvm_cpu_down_prepare(), registre syscore ops para hacer lo mismo para la CPU de arranque.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"arch/x86/kernel/kvm.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"fd10cde9294f73eeccbc16f3fec1ae6cde7b800c\",\"lessThan\":\"7620a669111b52f224d006dea9e1e688e2d62c54\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fd10cde9294f73eeccbc16f3fec1ae6cde7b800c\",\"lessThan\":\"38b858da1c58ad46519a257764e059e663b59ff2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fd10cde9294f73eeccbc16f3fec1ae6cde7b800c\",\"lessThan\":\"d1629b5b925de9b27979e929dae7fcb766daf6b6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fd10cde9294f73eeccbc16f3fec1ae6cde7b800c\",\"lessThan\":\"8b79feffeca28c5459458fe78676b081e87c93a4\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"arch/x86/kernel/kvm.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.38\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.38\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.125\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.43\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.12.10\",\"lessThanOrEqual\":\"5.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.13\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-03-18T20:26:26.037473Z\",\"id\":\"CVE-2021-47112\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"5.4.125\",\"matchCriteriaId\":\"F463D47B-F1A3-457B-87D0-92D3B3A033B0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.43\",\"matchCriteriaId\":\"B2136BD5-4F86-40C8-96C8-5C90A015490C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.12.10\",\"matchCriteriaId\":\"27384800-AB48-4C08-891E-34B66F5FC4AA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.13:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"0CBAD0FC-C281-4666-AB2F-F8E6E1165DF7\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/38b858da1c58ad46519a257764e059e663b59ff2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7620a669111b52f224d006dea9e1e688e2d62c54\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8b79feffeca28c5459458fe78676b081e87c93a4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d1629b5b925de9b27979e929dae7fcb766daf6b6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/38b858da1c58ad46519a257764e059e663b59ff2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7620a669111b52f224d006dea9e1e688e2d62c54\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8b79feffeca28c5459458fe78676b081e87c93a4\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d1629b5b925de9b27979e929dae7fcb766daf6b6\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T23:05:16+00:00",
      "cve": "CVE-2021-47112",
      "id": "CVE-2021-47112",
      "initial_release_date": "2021-01-01T00:00:00+00:00",
      "product_status:known_affected": "42",
      "product_status:known_not_affected": "156",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: x86/kvm: Teardown PV features on boot CPU as well",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-47112.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-08T00:05:52Z",
      "cve": "CVE-2021-47112",
      "id": "CVE-2021-47112",
      "initial_release_date": "2024-03-19T03:50:26Z",
      "product_status:known_affected": "483",
      "product_status:known_not_affected": "198",
      "product_status:recommended": "221",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2021-47112",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2021-47112.json",
      "version": "58"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/7620a669111b52f224d006dea9e1e688e2d62c54\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/38b858da1c58ad46519a257764e059e663b59ff2\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/d1629b5b925de9b27979e929dae7fcb766daf6b6\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/8b79feffeca28c5459458fe78676b081e87c93a4\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T05:24:39.829Z\"}}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-47112\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-03-18T20:26:26.037473Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T19:01:18.574Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"x86/kvm: Teardown PV features on boot CPU as well\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The bug is in guest-side KVM paravirt code (arch/x86/kernel/kvm.c) and is reached only when the guest performs local hibernation/suspend-to-disk (write to /sys/power/state or logind), not via network packets or adjacent-link protocols.\\nAC:L - On a KVM guest with PV features (steal time/PV EOI/async PF), initiating hibernate/resume cycles deterministically leaves boot-CPU PV MSRs enabled so the hypervisor keeps writing shared structures; Ubuntu reproduced reliable memory corruption after repeated hibernate/resume with no attacker-uncontrollable race.\\nPR:L - An active local seat user can trigger hibernate/suspend through logind/polkit without real init-namespace root, matching the worst reasonable desktop/laptop KVM-guest deployment; this does not require capabilities obtainable only outside user namespaces.\\nUI:N - The attacker initiates hibernation/resume themselves (or the same path is entered by session autosleep); no separate victim action such as mounting a filesystem or opening a crafted file is required.\\nS:U - Impact is memory corruption inside the guest kernel from incomplete PV teardown; this is not a guest-to-host escape, IOMMU bypass, or other cross-authority breakout (the host already fully controls guest memory).\\nC:H - Hypervisor writes into stale guest GPAs after resume corrupt arbitrary kernel pages that reused those locations (observed page-flag corruption); such kernel memory corruption can be leveraged for information disclosure.\\nI:H - The same stale-GPA writes are kernel memory corruption (page metadata and whatever structures land at the still-registered GPAs), which is exploitable for integrity break / control-flow hijacking under the higher-severity memory-corruption guidance.\\nA:H - The corruption manifests as BUG: Bad page state / page-allocator failures and can oops/panic or otherwise crash the guest kernel after hibernation resume, fully denying availability.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"fd10cde9294f73eeccbc16f3fec1ae6cde7b800c\", \"lessThan\": \"7620a669111b52f224d006dea9e1e688e2d62c54\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"fd10cde9294f73eeccbc16f3fec1ae6cde7b800c\", \"lessThan\": \"38b858da1c58ad46519a257764e059e663b59ff2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"fd10cde9294f73eeccbc16f3fec1ae6cde7b800c\", \"lessThan\": \"d1629b5b925de9b27979e929dae7fcb766daf6b6\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"fd10cde9294f73eeccbc16f3fec1ae6cde7b800c\", \"lessThan\": \"8b79feffeca28c5459458fe78676b081e87c93a4\", \"versionType\": \"git\"}], \"programFiles\": [\"arch/x86/kernel/kvm.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.6.38\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"2.6.38\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.4.125\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.43\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.12.10\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.12.*\"}, {\"status\": \"unaffected\", \"version\": \"5.13\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"arch/x86/kernel/kvm.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/7620a669111b52f224d006dea9e1e688e2d62c54\"}, {\"url\": \"https://git.kernel.org/stable/c/38b858da1c58ad46519a257764e059e663b59ff2\"}, {\"url\": \"https://git.kernel.org/stable/c/d1629b5b925de9b27979e929dae7fcb766daf6b6\"}, {\"url\": \"https://git.kernel.org/stable/c/8b79feffeca28c5459458fe78676b081e87c93a4\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nx86/kvm: Teardown PV features on boot CPU as well\\n\\nVarious PV features (Async PF, PV EOI, steal time) work through memory\\nshared with hypervisor and when we restore from hibernation we must\\nproperly teardown all these features to make sure hypervisor doesn\u0027t\\nwrite to stale locations after we jump to the previously hibernated kernel\\n(which can try to place anything there). For secondary CPUs the job is\\nalready done by kvm_cpu_down_prepare(), register syscore ops to do\\nthe same for boot CPU.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.125\", \"versionStartIncluding\": \"2.6.38\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.43\", \"versionStartIncluding\": \"2.6.38\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.12.10\", \"versionStartIncluding\": \"2.6.38\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.13\", \"versionStartIncluding\": \"2.6.38\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T08:46:05.685Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2021-47112\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T08:46:05.685Z\", \"dateReserved\": \"2024-03-04T18:12:48.836Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-03-15T20:14:20.602Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.