high 7.1

CVE-2021-47465 json

KVM: PPC: Book3S HV: Fix stack handling in idle_kvm_start_guest()

published 2024-05-22 2y ago modified 2026-08-05 3mo ago also EUVD-2021-34470

cvss: 7.1; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 13%
public exploits: 0; none known

In the Linux kernel, the following vulnerability has been resolved:

In commit 10d91611f426 ("powerpc/64s: Reimplement book3s idle code in C") kvm_start_guest() became idle_kvm_start_guest(). The old code allocated a stack frame on the emergency stack, but didn't use the frame to store anything, and also didn't store anything in its caller's frame.

idle_kvm_start_guest() on the other hand is written more like a normal C function, it creates a frame on entry, and also stores CR/LR into its callers frame (per the ABI). The problem is that there is no caller frame on the emergency stack.

The emergency stack for a given CPU is allocated with:

paca_ptrs[i]->emergency_sp = alloc_stack(limit, i) + THREAD_SIZE;

So emergency_sp actually points to the first address above the emergency stack allocation for a given CPU, we must not store above it without first decrementing it to create a frame. This is different to the regular kernel stack, paca->kstack, which is initialised to point at an initial frame that is ready to use.

idle_kvm_start_guest() stores the backchain, CR and LR all of which write outside the allocation for the emergency stack. It then creates a stack frame and saves the non-volatile registers. Unfortunately the frame it creates is not large enough to fit the non-volatiles, and so the saving of the non-volatile registers also writes outside the emergency stack allocation.

The end result is that we corrupt whatever is at 0-24 bytes, and 112-248 bytes above the emergency stack allocation.

In practice this has gone unnoticed because the memory immediately above the emergency stack happens to be used for other stack allocations, either another CPUs mc_emergency_sp or an IRQ stack. See the order of calls to irqstack_early_init() and emergency_stack_init().

The low addresses of another stack are the top of that stack, and so are only used if that stack is under extreme pressue, which essentially never happens in practice - and if it did there's a high likelyhood we'd crash due to that stack overflowing.

Still, we shouldn't be corrupting someone else's stack, and it is purely luck that we aren't corrupting something else.

To fix it we save CR/LR into the caller's frame using the existing r1 on entry, we then create a SWITCH_FRAME_SIZE frame (which has space for pt_regs) on the emergency stack with the backchain pointing to the existing stack, and then finally we switch to the new frame on the emergency stack.

Patch / fix

fixed in 1 distros 3 links 4

Linux Linux 5.4.156, 5.10.76, 5.14.15, 5.15

debian ubuntu suse

linux Debian 14, Debian 13, Debian 12 5.14.16-1

debian advisories DEBIAN-CVE-2021-47465

linux Ubuntu 20.04 LTS 5.4.0-92.103
linux-aws Ubuntu 20.04 LTS 5.4.0-1061.64
linux-gcp Ubuntu 20.04 LTS 5.4.0-1059.63
linux-ibm Ubuntu 20.04 LTS 5.4.0-1010.11
linux-kvm Ubuntu 20.04 LTS 5.4.0-1051.53
linux-azure Ubuntu 20.04 LTS 5.4.0-1065.68
linux-gkeop Ubuntu 20.04 LTS 5.4.0-1029.30
linux-raspi Ubuntu 20.04 LTS 5.4.0-1048.53

ubuntu advisories UBUNTU-CVE-2021-47465

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

dtb-aarch64 openSUSE Leap 15.5 5.14.21-150500.55.68.1
kernel-64kb SLE Module for Basesystem 15 SP5, openSUSE Leap 15.5 5.14.21-150500.55.68.1
kernel-syms SLE Module for Development Tools 15 SP5, openSUSE Leap 15.5 5.14.21-150500.55.68.1
kernel-obs-qa openSUSE Leap 15.5 5.14.21-150500.55.68.1
kernel-source SLE Module for Development Tools 15 SP5, SLE Module for Basesystem 15 SP5, openSUSE Leap 15.5 5.14.21-150500.55.68.1
kernel-default SLE Workstation Extension 15 SP5, SLE Module for Legacy 15 SP5, SLE Module for Basesystem 15 SP5 +4 more 5.14.21-150500.55.68.1
kernel-kvmsmall openSUSE Leap 15.5 5.14.21-150500.55.68.1
kernel-zfcpdump SLE Module for Basesystem 15 SP5, openSUSE Leap 15.5 5.14.21-150500.55.68.1

suse advisories SUSE-SU-2024:2190-1 SUSE-SU-2024:2189-1 SUSE-SU-2024:2185-1 SUSE-SU-2024:2183-1 SUSE-SU-2024:2019-1 SUSE-SU-2024:2011-1

Is CVE-2021-47465 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-47465 updated 2026-11-05 cvss 4.4

kernel: KVM: PPC: Book3S HV: Fix stack handling in idle_kvm_start_guest()

Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more
affected: no fix planned “Out of support scope”
Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +82 more
affected: no fix planned “Will not fix”
Red Hat Enterprise Linux 9 kernel-rt, kernel-rt-selftests-internal
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 2y ago (2024-05-29)

Exploit prediction

0.22% chance of exploitation in the next 30 days, higher than 13% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.1	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CISA ADP	3.1	7.1	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
NVD	3.1	5.5	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Linux Linux

Classification

Weakness

CWE-674 Uncontrolled Recursion

Technology feeds

Linux kernel rss critical rss

References

Sources

CVE List CVE-2021-47465
NVD CVE-2021-47465

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

json all entries feed