{
  "cveId": "CVE-2021-47390",
  "url": "https://patchblox.com/security/cve/CVE-2021-47390",
  "summary": "CVE-2021-47390 is fixed in linux on 1 platform, first by DEBIAN-CVE-2021-47390, released May 21, 2024. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  KVM: x86: Fix stack-out-of-bounds memory access...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  KVM: x86: Fix stack-out-of-bounds memory access from ioapic_write_indirect()  KASAN reports the following issue:   BUG: KASAN: stack-out-of-bounds in kvm_make_vcpus_request_mask\u002B0x174/0x440 [kvm]  Read of size 8 at addr ffffc9001364f638 by task qemu-kvm/4798   CPU: 0 PID: 4798 Comm: qemu-kvm Tainted: G               X --------- ---  Hardware name: AMD Corporation DAYTONA_X/DAYTONA_X, BIOS RYM0081C 07/13/2020  Call Trace:   dump_stack\u002B0xa5/0xe6   print_address_description.constprop.0\u002B0x18/0x130   ? kvm_make_vcpus_request_mask\u002B0x174/0x440 [kvm]   __kasan_report.cold\u002B0x7f/0x114   ? kvm_make_vcpus_request_mask\u002B0x174/0x440 [kvm]   kasan_report\u002B0x38/0x50   kasan_check_range\u002B0xf5/0x1d0   kvm_make_vcpus_request_mask\u002B0x174/0x440 [kvm]   kvm_make_scan_ioapic_request_mask\u002B0x84/0xc0 [kvm]   ? kvm_arch_exit\u002B0x110/0x110 [kvm]   ? sched_clock\u002B0x5/0x10   ioapic_write_indirect\u002B0x59f/0x9e0 [kvm]   ? static_obj\u002B0xc0/0xc0   ? __lock_acquired\u002B0x1d2/0x8c0   ? kvm_ioapic_eoi_inject_work\u002B0x120/0x120 [kvm]  The problem appears to be that \u0027vcpu_bitmap\u0027 is allocated as a single long on stack and it should really be KVM_MAX_VCPUS long. We also seem to clear the lower 16 bits of it with bitmap_zero() for no particular reason (my guess would be that \u0027bitmap\u0027 and \u0027vcpu_bitmap\u0027 variables in kvm_bitmap_or_dest_vcpus() caused the confusion: while the later is indeed 16-bit long, the later should accommodate all possible vCPUs).",
  "published": "2024-05-21T15:15:24Z",
  "severity": "high",
  "cvss": 7.1,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
  "epss": 0.00262,
  "epssPercentile": 0.18084,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "5.14.12-1",
      "fix": "DEBIAN-CVE-2021-47390",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2021-47390",
      "released": "2024-05-21T15:15:24Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "5.14.12-1",
      "fix": "DEBIAN-CVE-2021-47390",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2021-47390",
      "released": "2024-05-21T15:15:24Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "5.14.12-1",
      "fix": "DEBIAN-CVE-2021-47390",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2021-47390",
      "released": "2024-05-21T15:15:24Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T07:25:28Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}