Vulnerability in Kernel: x86/kvm: Disable kvmclock on all CPUs on shutdown
Summary
GSD-2021-1000786: x86/kvm: Disable kvmclock on all CPUs on shutdown. Affects Kernel versions < 3b0becf8b1ecf642a9edaf4c9628ffc641e490d6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a crucial component of the Linux operating system that acts as a bridge between the hardware and software layers. It provides essential services and manages system resources. The x86/kvm module within the Kernel enables virtualization on x86-based systems, allowing multiple virtual machines to run concurrently. One of the features provided by x86/kvm is kvmclock, which is responsible for timekeeping within virtual machines. However, a vulnerability has been discovered that affects the shutdown process of kvmclock on all CPUs.
Vulnerability Detail
The vulnerability in x86/kvm allows an attacker to exploit the shutdown process of kvmclock on all CPUs. This could potentially lead to a denial-of-service (DoS) attack or other security issues. By disabling kvmclock improperly, the system's timekeeping within virtual machines may become inaccurate or unstable. This vulnerability was introduced in an earlier version of the Linux Kernel and has been fixed in version v5.10.43 by commit 3b0becf8b1ecf642a9edaf4c9628ffc641e490d6.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to apply the fix by updating the Linux Kernel to the recommended version.
Conclusion
The vulnerability in x86/kvm that disables kvmclock on all CPUs during shutdown can potentially result in a denial-of-service attack or other security issues. It is crucial to update the Linux Kernel to version v5.10.43 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can potentially lead to a denial-of-service (DoS) attack or other security issues by affecting the timekeeping within virtual machines.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and it will provide real-time alerts for open-source vulnerabilities.
At the time of this report, there is no known exploit for this vulnerability. However, it is important to apply the fix as soon as possible to mitigate any potential risks.
Manually disabling kvmclock is not recommended as it may lead to inaccurate or unstable timekeeping within virtual machines. It is best to apply the fix by updating the Linux Kernel.
You can find more information about this vulnerability in the GSD Database entry: https://github.com/cloudsecurityalliance/gsd-database/blob/main/2021/1000xxx/GSD-2021-1000786.json
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
