CVE-2021-3656: High severity Linux Linux kernel vulnerability
A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMCB (virtual machine control block) provided by the L1 guest to spawn/handle a nested guest (L2). Due to improper validation of the "virtext" field, this issue could allow a malicious L1 to disable both VMLOAD/VMSAVE intercepts and VLS (Virtual VMLOAD/VMSAVE) for the L2 guest. As a result, the L2 guest would be allowed to read/write physical pages of the host, resulting in a crash of the entire system, leak of sensitive data or potential guest-to-host escape.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:3.10.0-1160.45.1.rt56.1185.el7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-1160.45.1.el7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-957.84.1.el7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-1062.59.1.el7 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-305.25.1.rt7.97.el8_4 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-305.25.1.el8_4 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-147.56.1.el8_1 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-193.68.1.rt13.118.el8_2 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-193.68.1.el8_2 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.14 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Configuration
Disable nested virtualization by unloading kvm_amd and reloading it with nested=0.
KVM AMD module (kvm_amd) nested = 0 - Configuration
As an alternative mitigation, disable Virtual VMLOAD/VMSAVE by unloading kvm_amd and reloading it with vls=0.
KVM AMD module (kvm_amd) vls = 0
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2021-3656?
CVE-2021-3656 has been assigned a severity rating of medium, indicating a moderate risk to the affected systems.
How do I fix CVE-2021-3656?
To mitigate CVE-2021-3656, users should upgrade to the patched kernel versions provided by Red Hat.
What systems are affected by CVE-2021-3656?
CVE-2021-3656 affects various versions of the Red Hat Enterprise Linux kernel and other related Linux distributions.
Can CVE-2021-3656 be exploited remotely?
Yes, CVE-2021-3656 can potentially be exploited remotely if an attacker gains access to the virtual machine environment.
What is the nature of the vulnerability described in CVE-2021-3656?
CVE-2021-3656 involves improper validation of the 'virt_ext' field in KVM's AMD code for nested virtualization.