Auth bypass in Linux Kernel
CVE-2021-3656
A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMCB (virtual machine control block) provided by the L1 guest to spawn/handle a nested guest (L2). Due to improper validation of the "virt_ext" field, this issue could allow a malicious L1 to disable both VMLOAD/VMSAVE intercepts and VLS (Virtual VMLOAD/VMSAVE) for the L2 guest. As a result, the L2 guest would be allowed to read/write physical pages of the host, resulting in a crash of the entire system, leak of sensitive data or potential guest-to-host escape.
Vulnerability class: Broken Access Control
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.007 (51.5th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 51st percentile — 51.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.007 · newest: 0.007 · change: 0.000
Affected products
- Linux Kernel — versions 5.14
- Fedoraproject Fedora — versions 33, 34
- Red Hat 3scale API Management — versions 2.0
- Red Hat Codeready Linux Builder
- Red Hat Enterprise Linux — versions 8.0, 7.0
- Red Hat Enterprise Linux Desktop — versions 7.0
- Red Hat Enterprise Linux Eus — versions 8.1, 8.2, 8.4
- Red Hat Enterprise Linux For IBM Z Systems — versions 7.0, 8.0
- Red Hat Enterprise Linux For IBM Z Systems Eus — versions 8.1, 8.2, 8.4
- Red Hat Enterprise Linux For Power Big Endian — versions 7.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- www.openwall.com/lists/oss-security/2021/08/16/1 (Mailing List, Third Party Advisory)
- git.kernel.org/pub/scm/virt/kvm/kvm.git/commit/ (Patch, Third Party Advisory)
- github.com/torvalds/linux/commit/c7dfa4009965a9b2d7b329ee970eb8da0d32f0bc (Patch, Third Party Advisory)
- bugzilla.redhat.com/show_bug.cgi (Third Party Advisory, Issue Tracking)
Frequently asked questions
- What is CVE-2021-3656?
- CVE-2021-3656 is a high-severity vulnerability in Linux Kernel, classified under Missing Authorization. CVSS score: 8.8/10. Published 2022-03-04.
- How severe is CVE-2021-3656?
- High severity. CVSS v3 base score is 8.8 out of 10.
- Is CVE-2021-3656 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.