CVE-2021-47465

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

KVM: PPC: Book3S HV: Fix stack handling in idle_kvm_start_guest()

In commit 10d91611f426 ("powerpc/64s: Reimplement book3s idle code in

C") kvm_start_guest() became idle_kvm_start_guest(). The old code

allocated a stack frame on the emergency stack, but didn't use the

frame to store anything, and also didn't store anything in its caller's

frame.

idle_kvm_start_guest() on the other hand is written more like a normal C

function, it creates a frame on entry, and also stores CR/LR into its

callers frame (per the ABI). The problem is that there is no caller

frame on the emergency stack.

The emergency stack for a given CPU is allocated with:

paca_ptrs[i]->emergency_sp = alloc_stack(limit, i) + THREAD_SIZE;

So emergency_sp actually points to the first address above the emergency

stack allocation for a given CPU, we must not store above it without

first decrementing it to create a frame. This is different to the

regula

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References