medium
5.5
Advisory Published
Updated

CVE-2021-46977: KVM: VMX: Disable preemption when probing user return MSRs

First published: Wed Feb 28 2024(Updated: )

In the Linux kernel, the following vulnerability has been resolved: KVM: VMX: Disable preemption when probing user return MSRs Disable preemption when probing a user return MSR via RDSMR/WRMSR. If the MSR holds a different value per logical CPU, the WRMSR could corrupt the host's value if KVM is preempted between the RDMSR and WRMSR, and then rescheduled on a different CPU. Opportunistically land the helper in common x86, SVM will use the helper in a future commit.

Credit: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Affected SoftwareAffected VersionHow to fix
Linux kernel>=5.5<5.10.38
Linux kernel>=5.11<5.11.22
Linux kernel>=5.12<5.12.5
Linux kernel=5.13-rc1

Remedy

https://git.kernel.org/stable/c/31f29749ee970c251b3a7e5b914108425940d089

Remedy

https://git.kernel.org/stable/c/5104d7ffcf24749939bea7fdb5378d186473f890

Remedy

https://git.kernel.org/stable/c/5adcdeb57007ccf8ab7ac20bf787ffb6fafb1a94

Remedy

https://git.kernel.org/stable/c/e3ea1895df719c4ef87862501bb10d95f4177bed

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is the severity of CVE-2021-46977?

    CVE-2021-46977 has a medium severity level due to potential privilege escalation risks.

  • How do I fix CVE-2021-46977?

    To fix CVE-2021-46977, update the Linux kernel to a version beyond 5.13-rc1, 5.12.5, 5.11.22, or 5.10.38.

  • Which versions of the Linux kernel are affected by CVE-2021-46977?

    CVE-2021-46977 affects Linux kernel versions 5.5 to 5.10.38, 5.11 to 5.11.22, and 5.12 to 5.12.5.

  • What type of vulnerability is CVE-2021-46977?

    CVE-2021-46977 is a vulnerability related to KVM (Kernel-based Virtual Machine) that impacts the handling of user return MSRs.

  • Can CVE-2021-46977 lead to system compromise?

    Yes, CVE-2021-46977 can potentially allow a local attacker to escalate privileges on the affected system.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203