In the Linux kernel, the following vulnerability has been resolved:
KVM: SVM: Use online_vcpus, not created_vcpus, to iterate over vCPUs
Use the kvm_for_each_vcpu() helper to iterate over vCPUs when encrypting
VMSAs for SEV, which effectively switches to use online_vcpus instead of
created_vcpus. This fixes a possible null-pointer dereference as
created_vcpus does not guarantee a vCPU exists, since it is updated at
the very beginning of KVM_CREATE_VCPU. created_vcpus exists to allow the
bulk of vCPU creation to run in parallel, while still correctly
restricting the max number of max vCPUs.
References
Configurations
Configuration 1 (hide)
|
History
10 Dec 2024, 16:43
Type | Values Removed | Values Added |
---|---|---|
CWE | CWE-476 | |
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.5 |
First Time |
Linux linux Kernel
Linux |
|
CPE | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | |
References | () https://git.kernel.org/stable/c/ba7bf5d6336aa9c0d977b161bfa420c56d46ee40 - Patch | |
References | () https://git.kernel.org/stable/c/bd0cced2ae93195668f983d443f7f17e8efd24d2 - Patch | |
References | () https://git.kernel.org/stable/c/c36b16d29f3af5f32fc1b2a3401bf48f71cabee1 - Patch |
Information
Published : 2024-02-29 23:15
Updated : 2024-12-10 16:43
NVD link : CVE-2021-47062
Mitre link : CVE-2021-47062
CVE.ORG link : CVE-2021-47062
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-476
NULL Pointer Dereference