A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMCB (virtual machine control block) provided by the L1 guest to spawn/handle a nested guest (L2). Due to improper validation of the "int_ctl" field, this issue could allow a malicious L1 to enable AVIC support (Advanced Virtual Interrupt Controller) for the L2 guest. As a result, the L2 guest would be allowed to read/write physical pages of the host, resulting in a crash of the entire system, leak of sensitive data or potential guest-to-host escape. This flaw affects Linux kernel versions prior to 5.14-rc7.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-tools-libs-devel | May 4, 2022 | Sep 29, 2021 |
| Amazon Linux Ami 2 | — | Upgrade kernel-headersUpgrade perf-debuginfoUpgrade kernel-tools-debuginfoUpgrade perfUpgrade kernel-livepatch-4.14.246-187.474Upgrade microvm-kernel-debuginfo-common-x86_64Upgrade kernel-tools-develUpgrade kernel-debuginfoUpgrade python-perf-debuginfoUpgrade kernel-develUpgrade kernelUpgrade microvm-kernel-debuginfoUpgrade microvm-kernel-develUpgrade kernel-debuginfo-common-aarch64Upgrade python-perfUpgrade kernel-livepatch-5.10.62-55.141Upgrade kernel-debuginfo-common-x86_64Upgrade microvm-kernel-headersUpgrade bpftoolUpgrade kernel-toolsUpgrade microvm-kernel-debuginfo-common-aarch64Upgrade bpftool-debuginfoUpgrade microvm-kernel | Sep 16, 2021 | Sep 16, 2021 |
| Centos_linux | — | Upgrade kernelUpgrade kernel-rt | Sep 16, 2021 | Sep 15, 2021 |
| Debian | — | Upgrade linux | Nov 29, 2021 | Sep 29, 2021 |
| Huawei Euleros 2_0_sp5 | — | Upgrade python-perfUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade kernelUpgrade kernel-headersUpgrade perfUpgrade kernel-devel | Mar 22, 2022 | Sep 29, 2021 |
| Huawei Euleros 2_0_sp9 | — | Upgrade kernelUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade python3-perf | Nov 12, 2021 | Nov 11, 2021 |
| Oracle_linux | — | Upgrade kernel-uekUpgrade kernel | Aug 17, 2021 | Aug 16, 2021 |
| Redhat_linux | — | Upgrade kernel-rtUpgrade kernelNo solution exists | Sep 16, 2021 | Sep 15, 2021 |
| Rocky_linux | — | Upgrade kernel-rt-debug-modulesUpgrade bpftoolUpgrade bpftool-debuginfoUpgrade kernel-rt-debugUpgrade kernel-tools-libsUpgrade kernel-modules-extraUpgrade kernel-modulesUpgrade kernel-rt-develUpgrade python3-perfUpgrade kernel-debug-modulesUpgrade python3-perf-debuginfoUpgrade kernel-rt-coreUpgrade kernel-develUpgrade kernel-headersUpgrade kernel-debugUpgrade kernel-debug-develUpgrade kernel-debuginfoUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-debug-develUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-tools-debuginfoUpgrade kernel-rt-debug-coreUpgrade kernel-debug-coreUpgrade kernel-coreUpgrade kernel-rt-debug-debuginfoUpgrade kernel-debug-debuginfoUpgrade kernel-rt-debuginfoUpgrade kernel-rtUpgrade kernel-toolsUpgrade perfUpgrade kernel-debug-modules-extraUpgrade kernel-debuginfo-common-x86_64Upgrade kernelUpgrade kernel-cross-headersUpgrade kernel-rt-modules-extraUpgrade kernel-rt-modulesUpgrade kernel-tools-libs-develUpgrade perf-debuginfo | Mar 12, 2024 | Sep 29, 2021 |
| Suse | — | Upgrade gfs2-kmp-64kbUpgrade dtb-socionextUpgrade kernel-default-livepatch-develUpgrade kernel-kvmsmall-develUpgrade kernel-64kb-optionalUpgrade kselftests-kmp-azureUpgrade dtb-broadcomUpgrade gfs2-kmp-preemptUpgrade kernel-azure-optionalUpgrade reiserfs-kmp-preemptUpgrade kernel-azure-baseUpgrade kernel-source-azureUpgrade kernel-debug-develUpgrade kernel-traceUpgrade dtb-marvellUpgrade kernel-default-baseUpgrade kernel-zfcpdump-manUpgrade kernel-vanilla-develUpgrade kernel-trace-develUpgrade kernel-paeUpgrade kernel-preempt-livepatch-develUpgrade kernel-kvmsmall-baseUpgrade kernel-64kb-livepatch-develUpgrade kernel-bigmem-baseUpgrade kernel-debugUpgrade kernel-trace-baseUpgrade kernel-bigmem-develUpgrade kernel-vanillaUpgrade kernel-default-kgraftUpgrade reiserfs-kmp-defaultUpgrade dtb-renesasUpgrade kernel-ec2Upgrade dtb-freescaleUpgrade kernel-bigmemUpgrade ocfs2-kmp-preemptUpgrade kernel-preempt-optionalUpgrade kernel-debug-livepatch-develUpgrade dtb-alteraUpgrade kernel-default-livepatchUpgrade kernel-macrosUpgrade dtb-amlogicUpgrade kernel-azure-extraUpgrade dtb-amdUpgrade kernel-docs-htmlUpgrade dtb-hisiliconUpgrade cluster-md-kmp-azureUpgrade dlm-kmp-64kbUpgrade kernel-symsUpgrade dlm-kmp-defaultUpgrade dtb-lgUpgrade kgraft-patch-4_4_180-94_144-defaultUpgrade gfs2-kmp-azureUpgrade kernel-default-manUpgrade kernel-default-develUpgrade kselftests-kmp-64kbUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-source-vanillaUpgrade kernel-zfcpdumpUpgrade kernel-xenUpgrade ocfs2-kmp-64kbUpgrade kernel-64kbUpgrade reiserfs-kmp-64kbUpgrade kernel-pae-develUpgrade ocfs2-kmp-azureUpgrade kernel-azureUpgrade kernel-ec2-baseUpgrade kernel-xen-develUpgrade kernel-obs-buildUpgrade dtb-armUpgrade dtb-xilinxUpgrade kernel-preempt-extraUpgrade kernel-syms-azureUpgrade kernel-ppc64-baseUpgrade reiserfs-kmp-azureUpgrade kernel-xen-baseUpgrade gfs2-kmp-defaultUpgrade kernel-ppc64Upgrade kernel-devel-azureUpgrade kernel-default-optionalUpgrade kernel-64kb-extraUpgrade kernel-pae-baseUpgrade kernel-azure-livepatch-develUpgrade kgraft-patch-4_4_180-94_141-defaultUpgrade dtb-sprdUpgrade kernel-vanilla-baseUpgrade kernel-obs-qaUpgrade dtb-zteUpgrade kernel-vanilla-livepatch-develUpgrade dtb-qcomUpgrade ocfs2-kmp-defaultUpgrade kernel-64kb-develUpgrade kernel-default-base-rebuildUpgrade kernel-debug-baseUpgrade kernel-default-extraUpgrade dlm-kmp-azureUpgrade kselftests-kmp-defaultUpgrade dtb-alUpgrade kernel-sourceUpgrade dtb-allwinnerUpgrade kernel-docsUpgrade kgraft-patch-4_4_180-94_147-defaultUpgrade kernel-preemptUpgrade kernel-develUpgrade kernel-defaultUpgrade dtb-mediatekUpgrade dtb-apmUpgrade cluster-md-kmp-defaultUpgrade cluster-md-kmp-preemptUpgrade kernel-ec2-develUpgrade dtb-rockchipUpgrade kgraft-patch-4_4_180-94_138-defaultUpgrade kgraft-patch-4_4_180-94_150-defaultUpgrade kgraft-patch-4_4_180-94_130-defaultUpgrade kernel-ppc64-develUpgrade kernel-azure-develUpgrade kselftests-kmp-preemptUpgrade kgraft-patch-4_4_180-94_135-defaultUpgrade dlm-kmp-preemptUpgrade dtb-caviumUpgrade kernel-kvmsmallUpgrade dtb-nvidiaUpgrade kernel-preempt-develUpgrade cluster-md-kmp-64kbUpgrade dtb-exynos | Sep 16, 2021 | Aug 16, 2021 |
| Ubuntu | — | Upgrade linux-image-virtual-lts-xenialUpgrade linux-image-5.11.0-34-genericUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-4.15.0-1027-dell300xUpgrade linux-image-4.15.0-1123-azureUpgrade linux-image-5.11.0-1017-awsUpgrade linux-image-4.15.0-1080-oracleUpgrade linux-image-5.10.0-1045-oemUpgrade linux-image-5.4.0-84-genericUpgrade linux-image-lowlatency-lts-xenialUpgrade linux-image-virtual-hwe-16.04Upgrade linux-image-gcpUpgrade linux-image-raspi-nolpaeUpgrade linux-image-gcp-lts-20.04Upgrade linux-image-5.4.0-1046-kvmUpgrade linux-image-virtualUpgrade linux-image-5.4.0-1054-oracleUpgrade linux-image-azure-lts-20.04Upgrade linux-image-5.11.0-1018-gcpUpgrade linux-image-oracle-lts-20.04Upgrade linux-image-oem-20.04Upgrade linux-image-gkeUpgrade linux-image-oracleUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-aws-lts-18.04Upgrade linux-image-4.15.0-156-genericUpgrade linux-image-snapdragonUpgrade linux-image-4.4.0-1097-kvmUpgrade linux-image-5.4.0-1058-azureUpgrade linux-image-oemUpgrade linux-image-5.4.0-84-generic-lpaeUpgrade linux-image-5.8.0-1041-azureUpgrade linux-image-generic-lts-xenialUpgrade linux-image-4.4.0-214-genericUpgrade linux-image-awsUpgrade linux-image-generic-hwe-16.04Upgrade linux-image-gke-5.4Upgrade linux-image-generic-lpaeUpgrade linux-image-kvmUpgrade linux-image-4.15.0-1108-gcpUpgrade linux-image-gcp-lts-18.04Upgrade linux-image-5.4.0-84-lowlatencyUpgrade linux-image-virtual-hwe-18.04Upgrade linux-image-lowlatency-hwe-16.04Upgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-oem-osp1Upgrade linux-image-5.4.0-1023-gkeopUpgrade linux-image-oracle-lts-18.04Upgrade linux-image-5.11.0-1015-kvmUpgrade linux-image-oem-20.04cUpgrade linux-image-4.15.0-156-lowlatencyUpgrade linux-image-azureUpgrade linux-image-gkeop-5.4Upgrade linux-image-aws-hweUpgrade linux-image-5.11.0-1017-raspi-nolpaeUpgrade linux-image-5.11.0-1017-raspiUpgrade linux-image-4.15.0-156-generic-lpaeUpgrade linux-image-aws-lts-20.04Upgrade linux-image-virtual-hwe-20.04Upgrade linux-image-gkeopUpgrade linux-image-genericUpgrade linux-image-4.15.0-1099-kvmUpgrade linux-image-5.4.0-1056-awsUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-5.11.0-34-generic-lpaeUpgrade linux-image-4.4.0-1096-awsUpgrade linux-image-5.13.0-1012-oemUpgrade linux-image-5.11.0-34-lowlatencyUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-4.4.0-214-lowlatencyUpgrade linux-image-5.4.0-1052-gcpUpgrade linux-image-generic-lpae-hwe-18.04Upgrade linux-image-lowlatencyUpgrade linux-image-5.11.0-1015-azureUpgrade linux-image-generic-hwe-18.04Upgrade linux-image-5.11.0-1017-oracleUpgrade linux-image-4.4.0-1132-awsUpgrade linux-image-5.4.0-1052-gkeUpgrade linux-image-raspiUpgrade linux-image-dell300xUpgrade linux-image-azure-lts-18.04Upgrade linux-image-5.11.0-34-generic-64kUpgrade linux-image-4.15.0-1112-snapdragonUpgrade linux-image-oem-20.04bUpgrade linux-image-4.15.0-1111-awsUpgrade linux-image-generic-64k | Sep 8, 2021 | Aug 16, 2021 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Sep 29, 2021 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub