CVE-2021-47277

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

kvm: avoid speculation-based attacks from out-of-range memslot accesses

KVM's mechanism for accessing guest memory translates a guest physical

address (gpa) to a host virtual address using the right-shifted gpa

(also known as gfn) and a struct kvm_memory_slot. The translation is

performed in __gfn_to_hva_memslot using the following formula:

hva = slot->userspace_addr + (gfn - slot->base_gfn) * PAGE_SIZE

It is expected that gfn falls within the boundaries of the guest's

physical memory. However, a guest can access invalid physical addresses

in such a way that the gfn is invalid.

__gfn_to_hva_memslot is called from kvm_vcpu_gfn_to_hva_prot, which first

retrieves a memslot through __gfn_to_memslot. While __gfn_to_memslot

does check that the gfn falls within the boundaries of the guest's

physical memory or not, a CPU can speculate the result of the check and

continue execution speculatively using an illegal g

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References