CVE-2021-47060: KVM: Stop looking for coalesced MMIO zones if the bus is destroyed
First published: Thu Feb 29 2024(Updated: )
In the Linux kernel, the following vulnerability has been resolved: KVM: Stop looking for coalesced MMIO zones if the bus is destroyed Abort the walk of coalesced MMIO zones if kvm_io_bus_unregister_dev() fails to allocate memory for the new instance of the bus. If it can't instantiate a new bus, unregister_dev() destroys all devices _except_ the target device. But, it doesn't tell the caller that it obliterated the bus and invoked the destructor for all devices that were on the bus. In the coalesced MMIO case, this can result in a deleted list entry dereference due to attempting to continue iterating on coalesced_zones after future entries (in the walk) have been deleted. Opportunistically add curly braces to the for-loop, which encompasses many lines but sneaks by without braces due to the guts being a single if statement.
Credit: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linux Kernel | >=5.4.66<5.4.119 | |
| Linux Kernel | >=5.9<5.10.37 | |
| Linux Kernel | >=5.11<5.11.21 | |
| Linux Kernel | >=5.12<5.12.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://git.kernel.org/stable/c/7d1bc32d6477ff96a32695ea4be8144e4513ab2d
- https://git.kernel.org/stable/c/2a20592baff59c5351c5200ec667e1a2aa22af85
- https://git.kernel.org/stable/c/168e82f640ed1891a700bdb43e37da354b2ab63c
- https://git.kernel.org/stable/c/50cbad42bfea8c052b7ca590bd4126cdc898713c
- https://git.kernel.org/stable/c/5d3c4c79384af06e3c8e25b7770b6247496b4417
Frequently Asked Questions
What is the severity of CVE-2021-47060?
The severity of CVE-2021-47060 is classified as medium due to potential memory allocation issues within the Linux kernel.
What versions of the Linux kernel are affected by CVE-2021-47060?
CVE-2021-47060 affects Linux kernel versions between 5.4.66 and 5.4.119, 5.9 and 5.10.37, as well as versions 5.11 and 5.11.21, and 5.12 and 5.12.4.
How do I fix CVE-2021-47060?
To fix CVE-2021-47060, update your Linux kernel to a version that is not affected by the vulnerability.
What impact does CVE-2021-47060 have on system security?
CVE-2021-47060 may lead to improper handling of memory for coalesced MMIO zones which could affect system stability.
Is there a workaround for CVE-2021-47060?
There is no specific workaround for CVE-2021-47060, and it is recommended to apply the available patches as soon as possible.
- agent/title
- agent/references
- agent/description
- agent/first-publish-date
- agent/type
- agent/author
- agent/severity
- collector/mitre-cve
- source/MITRE
- agent/source
- agent/last-modified-date
- agent/remedy
- agent/softwarecombine
- agent/tags
- agent/event
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- vendor/linux
- canonical/linux kernel
- version/linux kernel/5.4.66
- version/linux kernel/5.9
- version/linux kernel/5.11
- version/linux kernel/5.12