ALT-PU-2021-1639-1

Package update kernel-image-un-def in branch p9

Version5.10.28-alt1

Published2021-04-12

Max severityHIGH

Severity:

Closed issues (2)

HIGH7.4

Уязвимость компонента arch/x86/kvm/svm/nested.c операционной системы Linux , связанная с использованием памяти после её освобождения, позволяющая нарушителю повысить свои привилегии

Published: 2021-10-05Modified: 2024-09-13

CVSS 3.xHIGH 7.4

CVSS:3.x/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS 2.0MEDIUM 6.9

CVSS:2.0/AV:L/AC:M/Au:N/C:C/I:C/A:C

References

CVE-2021-29657

HIGH7.4

arch/x86/kvm/svm/nested.c in the Linux kernel before 5.11.12 has a use-after-free in which an AMD KVM guest can bypass access control on host OS MSRs when there are nested guests, aka CID-a58d9166a756. This occurs because of a TOCTOU race condition associated with a VMCB12 double fetch in nested_svm_vmrun.

Published: 2021-07-22Modified: 2024-11-21

CVSS 2.0MEDIUM 6.9

CVSS:2.0/AV:L/AC:M/Au:N/C:C/I:C/A:C

CVSS 3.xHIGH 7.4

CVSS:3.x/CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References