CVE-2021-29657
published 2021-07-22CVE-2021-29657: arch/x86/kvm/svm/nested.c in the Linux kernel before 5.11.12 has a use-after-free in which an AMD KVM guest can bypass access control on host OS MSRs when…
PriorityP337high7.4CVSS 3.1
AVLACHPRNUINSUCHIHAH
EPSS
0.41%
34.0th percentile
arch/x86/kvm/svm/nested.c in the Linux kernel before 5.11.12 has a use-after-free in which an AMD KVM guest can bypass access control on host OS MSRs when there are nested guests, aka CID-a58d9166a756. This occurs because of a TOCTOU race condition associated with a VMCB12 double fetch in nested_svm_vmrun.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.10.28-1 (bookworm) | linux 5.10.28-1 (bookworm) |
| linux | linux_kernel | >= 0 < 5.10.28-1 | 5.10.28-1 |
| linux | linux_kernel | >= 0 < 5.10.28-1 | 5.10.28-1 |
| linux | linux_kernel | >= 0 < 5.10.28-1 | 5.10.28-1 |
| linux | linux_kernel | >= 0 < 5.10.28-1 | 5.10.28-1 |
| linux | linux_kernel | >= 5.10 < 5.10.28 | 5.10.28 |
| linux | linux_kernel | >= 5.11 < 5.11.12 | 5.11.12 |
| msrc | cbl2_kernel_5.10.78.1-1_on_cbl_mariner_2.0 | — | — |
| msrc | cm1_kernel_5.10.60.1-1_on_cbl_mariner_1.0 | — | — |
CVSS provenance
nvdv3.17.4HIGHCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.9MEDIUMAV:L/AC:M/Au:N/C:C/I:C/A:C
osv7.8HIGH
vendor_ubuntu7.8HIGH
vendor_debian7.4HIGH
vendor_msrc7.4HIGH
vendor_redhat7.4HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-m46m-jr5m-g95h: arch/x86/kvm/svm/nested
ghsa_unreviewed·2022-05-24
CVE-2021-29657 [HIGH] CWE-367 GHSA-m46m-jr5m-g95h: arch/x86/kvm/svm/nested
arch/x86/kvm/svm/nested.c in the Linux kernel before 5.11.12 has a use-after-free in which an AMD KVM guest can bypass access control on host OS MSRs when there are nested guests, aka CID-a58d9166a756. This occurs because of a TOCTOU race condition associated with a VMCB12 double fetch in nested_svm_vmrun.
OSV
CVE-2021-29657: arch/x86/kvm/svm/nested
osv·2021-07-22·CVSS 7.4
CVE-2021-29657 [HIGH] CVE-2021-29657: arch/x86/kvm/svm/nested
arch/x86/kvm/svm/nested.c in the Linux kernel before 5.11.12 has a use-after-free in which an AMD KVM guest can bypass access control on host OS MSRs when there are nested guests, aka CID-a58d9166a756. This occurs because of a TOCTOU race condition associated with a VMCB12 double fetch in nested_svm_vmrun.
Project0
An EPYC escape: Case-study of a KVM breakout - Project Zero
project_zero·2021-06-01·CVSS 7.4
CVE-2021-29657 [HIGH] An EPYC escape: Case-study of a KVM breakout - Project Zero
Posted by Felix Wilhelm, Project Zero
## Introduction
KVM (for Kernel-based Virtual Machine) is the de-facto standard hypervisor for Linux-based cloud environments. Outside of Azure, almost all large-scale cloud and hosting providers are running on top of KVM, turning it into one of the fundamental security boundaries in the cloud.
In this blog post I describe a vulnerability in KVM’s AMD-specific code and discuss how this bug can be turned into a full virtual machine escape. To the best of my knowledge, this is the first public writeup of a KVM guest-to-host breakout that does not rely on bugs in user space components such as QEMU. The discussed bug was assigned CVE-2021-29657, affects kernel versions v5.10-rc1 to v5.12-rc6 and was patched at the end of March 2021. As the bug only
OSV
linux-oem-5.10 vulnerabilities
osv·2021-05-11·CVSS 7.8
CVE-2021-3489 [HIGH] linux-oem-5.10 vulnerabilities
linux-oem-5.10 vulnerabilities
Ryota Shiga discovered that the eBPF implementation in the Linux kernel did
not properly verify that a BPF program only reserved as much memory for a
ring buffer as was allocated. A local attacker could use this to cause a
denial of service (system crash) or execute arbitrary code. (CVE-2021-3489)
Manfred Paul discovered that the eBPF implementation in the Linux kernel
did not properly track bounds on bitwise operations. A local attacker could
use this to cause a denial of service (system crash) or execute arbitrary
code. (CVE-2021-3490)
Billy Jheng Bing-Jhong discovered that the io_uring implementation of the
Linux kernel did not properly enforce the MAX_RW_COUNT limit in some
situations. A local attacker could use this to cause a denial of service
(syste
Kernel
KVM: SVM: load control fields from VMCB12 before checking them
kernel_security·2021-03-31·CVSS 7.4
CVE-2021-29657 [HIGH] KVM: SVM: load control fields from VMCB12 before checking them
KVM: SVM: load control fields from VMCB12 before checking them
Avoid races between check and use of the nested VMCB controls. This
for example ensures that the VMRUN intercept is always reflected to the
nested hypervisor, instead of being processed by the host. Without this
patch, it is possible to end up with svm->nested.hsave pointing to
the MSR permission bitmap for nested guests.
This bug is CVE-2021-29657.
Reported-by: Felix Wilhelm
Cc: [email protected]
Fixes: 2fcf4876ada ("KVM: nSVM: implement on demand allocation of the nested state")
Signed-off-by: Paolo Bonzini
Microsoft
arch/x86/kvm/svm/nested.c in the Linux kernel before 5.11.12 has a use-after-free in which an AMD KVM guest can bypass access control on host OS MSRs when there are nested guests aka CID-a58d9166a756.
vendor_msrc·2021-07-13·CVSS 7.4
CVE-2021-29657 [HIGH] CWE-416 arch/x86/kvm/svm/nested.c in the Linux kernel before 5.11.12 has a use-after-free in which an AMD KVM guest can bypass access control on host OS MSRs when there are nested guests aka CID-a58d9166a756.
arch/x86/kvm/svm/nested.c in the Linux kernel before 5.11.12 has a use-after-free in which an AMD KVM guest can bypass access control on host OS MSRs when there are nested guests aka CID-a58d9166a756. This occurs because of a TOCTOU race condition associated with a VMCB12 double fetch in nested_svm_vmrun.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. S
Ubuntu
Linux kernel (OEM) vulnerabilities
vendor_ubuntu·2021-05-11·CVSS 7.8
CVE-2021-3489 [HIGH] Linux kernel (OEM) vulnerabilities
Title: Linux kernel (OEM) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Ryota Shiga discovered that the eBPF implementation in the Linux kernel did
not properly verify that a BPF program only reserved as much memory for a
ring buffer as was allocated. A local attacker could use this to cause a
denial of service (system crash) or execute arbitrary code. (CVE-2021-3489)
Manfred Paul discovered that the eBPF implementation in the Linux kernel
did not properly track bounds on bitwise operations. A local attacker could
use this to cause a denial of service (system crash) or execute arbitrary
code. (CVE-2021-3490)
Billy Jheng Bing-Jhong discovered that the io_uring implementation of the
Linux kernel did not properly enforce the MAX_RW_COUNT limit in some
si
Red Hat
kernel: KVM: double fetch in nested_svm_vmrun can lead to unrestricted MSR access
vendor_redhat·2021-03-31·CVSS 7.4
CVE-2021-29657 [HIGH] CWE-367 kernel: KVM: double fetch in nested_svm_vmrun can lead to unrestricted MSR access
kernel: KVM: double fetch in nested_svm_vmrun can lead to unrestricted MSR access
arch/x86/kvm/svm/nested.c in the Linux kernel before 5.11.12 has a use-after-free in which an AMD KVM guest can bypass access control on host OS MSRs when there are nested guests, aka CID-a58d9166a756. This occurs because of a TOCTOU race condition associated with a VMCB12 double fetch in nested_svm_vmrun.
A flaw was found in the Linux kernel. A KVM guest on AMD can launch a nested guest without the Intercept VMRUN control bit by exploiting a TOCTOU vulnerability in nested_svm_vmrun. A malicious guest could use this flaw to gain unrestricted access to host MSRs, possibly leading to guest-to-host escape scenario.
Statement: The nested virtualization feature is not enabled by default up to Red Hat Enterprise
Debian
CVE-2021-29657: linux - arch/x86/kvm/svm/nested.c in the Linux kernel before 5.11.12 has a use-after-fre...
vendor_debian·2021·CVSS 7.4
CVE-2021-29657 [HIGH] CVE-2021-29657: linux - arch/x86/kvm/svm/nested.c in the Linux kernel before 5.11.12 has a use-after-fre...
arch/x86/kvm/svm/nested.c in the Linux kernel before 5.11.12 has a use-after-free in which an AMD KVM guest can bypass access control on host OS MSRs when there are nested guests, aka CID-a58d9166a756. This occurs because of a TOCTOU race condition associated with a VMCB12 double fetch in nested_svm_vmrun.
Scope: local
bookworm: resolved (fixed in 5.10.28-1)
bullseye: resolved (fixed in 5.10.28-1)
forky: resolved (fixed in 5.10.28-1)
sid: resolved (fixed in 5.10.28-1)
trixie: resolved (fixed in 5.10.28-1)
No detection rules found.
No public exploits indexed.
http://packetstormsecurity.com/files/163324/KVM-nested_svm_vmrun-Double-Fetch.htmlhttps://bugs.chromium.org/p/project-zero/issues/detail?id=2177https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.11.12https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a58d9166a756a0f4a6618e4f593232593d6df134https://security.netapp.com/advisory/ntap-20210902-0008/http://packetstormsecurity.com/files/163324/KVM-nested_svm_vmrun-Double-Fetch.htmlhttps://bugs.chromium.org/p/project-zero/issues/detail?id=2177https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.11.12https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a58d9166a756a0f4a6618e4f593232593d6df134https://security.netapp.com/advisory/ntap-20210902-0008/
2021-07-22
Published