KVM: MMU: shadow nested paging does not have PKU
Summary
GSD-2021-1002563: KVM: MMU: shadow nested paging does not have PKU. Affects Kernel versions < 87d9c628be264a4d2dbb9eb0e7d629aef8b66339. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a fundamental component of the Linux operating system. It provides the core functionality and interfaces for the system's hardware, software, and processes. The Kernel package is responsible for managing memory, scheduling tasks, and facilitating communication between different components. This vulnerability specifically affects the Kernel's MMU (Memory Management Unit) module, which is responsible for virtual memory management. The MMU uses shadow nested paging, but it lacks support for PKU (Protection Keys for Userspace).
Vulnerability Detail
The vulnerability arises from the absence of PKU support in the shadow nested paging implementation of the Kernel's MMU. PKU is a feature that allows userspace applications to define protection keys for memory regions, enabling fine-grained access control. Without PKU support, the MMU may not enforce the desired access restrictions, potentially leading to unauthorized access or privilege escalation. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The KVM: MMU: shadow nested paging vulnerability in the Kernel package has been identified and addressed in the Linux Kernel version v5.15.7. Users are advised to update their Kernel to at least this version to mitigate the risk of unauthorized access or privilege escalation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability is currently unknown as it has not been proven yet. However, if successfully exploited, it could potentially lead to unauthorized access or privilege escalation.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
No, there are no known workarounds for this vulnerability. It is recommended to update the Kernel to the fixed version as soon as possible.
No, there is currently no evidence of active exploits targeting this vulnerability. However, it is still important to apply the fix to ensure the security of your system.
You can find more information about this vulnerability in the GSD database entry: https://github.com/cloudsecurityalliance/gsd-database/blob/main/2021/1002xxx/GSD-2021-1002563.json
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
