KVM: PPC: Fix kvm_arch_vcpu_ioctl vcpu_load leak
Summary
GSD-2021-1001163: KVM: PPC: Fix kvm_arch_vcpu_ioctl vcpu_load leak. Affects Kernel versions >= b3cebfe8c1cadf1817939dcc3688a2504a69c662, < a4a488915feaad38345cc01b80d52e8200ff5209. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a crucial component of the Linux operating system. It provides the core functionality and interfaces for various hardware devices, including processors, memory, and input/output. The KVM (Kernel-based Virtual Machine) subsystem within the Kernel package enables the creation and management of virtual machines on a Linux host. It allows users to run multiple operating systems simultaneously on a single physical machine. The PowerPC (PPC) architecture is one of the supported architectures for KVM. This vulnerability specifically affects the PPC implementation of the kvm_arch_vcpu_ioctl function.
Vulnerability Detail
The vulnerability in the kvm_arch_vcpu_ioctl function in the PPC implementation of KVM allows for a resource leak. When handling certain ioctl requests, the function fails to release a vcpu_load structure, leading to a memory leak. An attacker could potentially exploit this vulnerability to exhaust system memory resources, resulting in a denial-of-service condition. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The KVM: PPC: Fix kvm_arch_vcpu_ioctl vcpu_load leak vulnerability in the Kernel package affects the PPC implementation of the KVM subsystem. It can potentially lead to a denial-of-service condition by exhausting system memory resources. It is recommended to update the Linux Kernel to version v5.13.6 or later to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability is a potential denial-of-service condition due to resource exhaustion. However, the actual impact and attack plausibility have not been proven yet.
You can use Vulert's playground at Vulert Scanner to check if your system is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
No, there are no known workarounds for this vulnerability. It is recommended to update the Linux Kernel to the fixed version.
Yes, this vulnerability specifically affects the PowerPC (PPC) implementation of the KVM subsystem in the Linux Kernel.
You can find more information about this vulnerability in the vulnerability database maintained by the Cloud Security Alliance. The specific vulnerability ID is GSD-2021-1001163. https://github.com/cloudsecurityalliance/gsd-database/blob/main/2021/1001xxx/GSD-2021-1001163.json
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
