KVM: arm64 Host Stage-2 PGD Refcount Vulnerability
Summary
GSD-2021-1002095: KVM: arm64: Fix host stage-2 PGD refcount. Affects Kernel versions >= 1025c8c0c6accfcbdc8f52ca1940160f65cd87d6, < b372264c66ef78f2cab44e877fbd765ad6d24c39. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a fundamental component of the Linux operating system, responsible for managing system resources and providing an interface between hardware and software. It includes various subsystems, such as memory management, process scheduling, and device drivers. The KVM (Kernel-based Virtual Machine) is a module within the Kernel that enables virtualization on the ARM64 architecture. It allows running multiple virtual machines (guests) on a single physical machine (host). The host stage-2 PGD (Page Global Directory) is a data structure used by the KVM to manage the translation of virtual addresses to physical addresses in the host's memory. This vulnerability affects the host stage-2 PGD refcount mechanism in the KVM, potentially leading to security issues and system instability.
Vulnerability Detail
The KVM host stage-2 PGD refcount vulnerability arises from a flaw in the refcount handling of the host stage-2 PGD. This flaw can be exploited by an attacker with local access to the host system to cause memory corruption or trigger a use-after-free condition. By carefully manipulating the refcount, an attacker may be able to gain elevated privileges, execute arbitrary code, or crash the system. The impact and attack plausibility of this vulnerability have not been proven yet. It is important to note that this vulnerability only affects systems running the ARM64 architecture with KVM enabled. Other architectures and virtualization technologies are not affected.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround available for this vulnerability. It is highly recommended to apply the official fix by updating the Linux Kernel to the recommended version.
Conclusion
The KVM: arm64 Host Stage-2 PGD Refcount Vulnerability is a security issue affecting the host stage-2 PGD refcount mechanism in the KVM module of the Linux Kernel. It can potentially lead to memory corruption, privilege escalation, arbitrary code execution, or system crashes. To mitigate this vulnerability, it is crucial to update the Linux Kernel to version v5.14.15 or later. No known workarounds are available. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability can vary depending on the attacker's capabilities and intentions. It could potentially lead to unauthorized access, privilege escalation, arbitrary code execution, or system crashes.
This vulnerability affects systems running the ARM64 architecture with KVM enabled. Other architectures and virtualization technologies are not affected.
No, this vulnerability requires local access to the host system. Remote exploitation is not possible.
There are no known instances of this vulnerability being exploited in the wild at the time of this report. However, it is important to apply the recommended fix to mitigate any potential risks.
Yes, you can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) to the playground, and it will provide real-time alerts for open-source vulnerabilities, including this one.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
