Vulnerability-Lookup

EUVD-2026-309638

European Vulnerability Database identifier assigned by ENISA

Reserved

2026-10-02 07:09

Assigner

ENISA

Alias of

a CVE record, shown under related vulnerabilities. This identifier carries no description, severity or references of its own: they belong to that CVE.

JSON

To clipboard

{
  "assigner": "ENISA",
  "date_reserved": "2026-10-02T07:09:28.157551+00:00",
  "id": "EUVD-2026-309638"
}

CVE-2021-47277 (GCVE-0-2021-47277)

Vulnerability from cvelistv5 – Published: 2024-05-21 14:20 – Updated: 2026-05-11 13:51

Title

kvm: avoid speculation-based attacks from out-of-range memslot accesses

Summary

In the Linux kernel, the following vulnerability has been resolved: kvm: avoid speculation-based attacks from out-of-range memslot accesses KVM's mechanism for accessing guest memory translates a guest physical address (gpa) to a host virtual address using the right-shifted gpa (also known as gfn) and a struct kvm_memory_slot. The translation is performed in __gfn_to_hva_memslot using the following formula: hva = slot->userspace_addr + (gfn - slot->base_gfn) * PAGE_SIZE It is expected that gfn falls within the boundaries of the guest's physical memory. However, a guest can access invalid physical addresses in such a way that the gfn is invalid. __gfn_to_hva_memslot is called from kvm_vcpu_gfn_to_hva_prot, which first retrieves a memslot through __gfn_to_memslot. While __gfn_to_memslot does check that the gfn falls within the boundaries of the guest's physical memory or not, a CPU can speculate the result of the check and continue execution speculatively using an illegal gfn. The speculation can result in calculating an out-of-bounds hva. If the resulting host virtual address is used to load another guest physical address, this is effectively a Spectre gadget consisting of two consecutive reads, the second of which is data dependent on the first. Right now it's not clear if there are any cases in which this is exploitable. One interesting case was reported by the original author of this patch, and involves visiting guest page tables on x86. Right now these are not vulnerable because the hva read goes through get_user(), which contains an LFENCE speculation barrier. However, there are patches in progress for x86 uaccess.h to mask kernel addresses instead of using LFENCE; once these land, a guest could use speculation to read from the VMM's ring 3 address space. Other architectures such as ARM already use the address masking method, and would be susceptible to this same kind of data-dependent access gadgets. Therefore, this patch proactively protects from these attacks by masking out-of-bounds gfns in __gfn_to_hva_memslot, which blocks speculation of invalid hvas. Sean Christopherson noted that this patch does not cover kvm_read_guest_offset_cached. This however is limited to a few bytes past the end of the cache, and therefore it is unlikely to be useful in the context of building a chain of data dependent accesses.

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-05-23 17:22 UTC

Assigner

Linux mitre root Scorecard

References

8 references

URL	Tags
https://git.kernel.org/stable/c/3098b86390a6b9ea5…
https://git.kernel.org/stable/c/740621309b25bbf61…
https://git.kernel.org/stable/c/361ce3b917aff9312…
https://git.kernel.org/stable/c/22b87fb17a28d3733…
https://git.kernel.org/stable/c/bff1fbf0cf0712686…
https://git.kernel.org/stable/c/7af299b97734c7e7f…
https://git.kernel.org/stable/c/ed0e2a893092c7fcb…
https://git.kernel.org/stable/c/da27a83fd6cc7780f…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 8a7ae055f3533b520401c170ac55e30628b34df5 , < 3098b86390a6b9ea52657689f08410baf130ceff (git) Affected: 8a7ae055f3533b520401c170ac55e30628b34df5 , < 740621309b25bbf619b8a0ba5fd50a8e58989441 (git) Affected: 8a7ae055f3533b520401c170ac55e30628b34df5 , < 361ce3b917aff93123e9e966d8608655c967f438 (git) Affected: 8a7ae055f3533b520401c170ac55e30628b34df5 , < 22b87fb17a28d37331bb9c1110737627b17f6781 (git) Affected: 8a7ae055f3533b520401c170ac55e30628b34df5 , < bff1fbf0cf0712686f1df59a83fba6e31d2746a0 (git) Affected: 8a7ae055f3533b520401c170ac55e30628b34df5 , < 7af299b97734c7e7f465b42a2139ce4d77246975 (git) Affected: 8a7ae055f3533b520401c170ac55e30628b34df5 , < ed0e2a893092c7fcb4ff7ba74e5efce53a6f5940 (git) Affected: 8a7ae055f3533b520401c170ac55e30628b34df5 , < da27a83fd6cc7780fea190e1f5c19e87019da65c (git)
Linux	Linux	Affected: 2.6.25 Unaffected: 0 , < 2.6.25 (semver) Unaffected: 4.4.273 , ≤ 4.4.* (semver) Unaffected: 4.9.273 , ≤ 4.9.* (semver) Unaffected: 4.14.237 , ≤ 4.14.* (semver) Unaffected: 4.19.195 , ≤ 4.19.* (semver) Unaffected: 5.4.126 , ≤ 5.4.* (semver) Unaffected: 5.10.44 , ≤ 5.10.* (semver) Unaffected: 5.12.11 , ≤ 5.12.* (semver) Unaffected: 5.13 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47277",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-23T17:22:08.771570Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:14:39.924Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:32:07.918Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3098b86390a6b9ea52657689f08410baf130ceff"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/740621309b25bbf619b8a0ba5fd50a8e58989441"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/361ce3b917aff93123e9e966d8608655c967f438"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/22b87fb17a28d37331bb9c1110737627b17f6781"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/bff1fbf0cf0712686f1df59a83fba6e31d2746a0"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/7af299b97734c7e7f465b42a2139ce4d77246975"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ed0e2a893092c7fcb4ff7ba74e5efce53a6f5940"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/da27a83fd6cc7780fea190e1f5c19e87019da65c"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/kvm_host.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3098b86390a6b9ea52657689f08410baf130ceff",
              "status": "affected",
              "version": "8a7ae055f3533b520401c170ac55e30628b34df5",
              "versionType": "git"
            },
            {
              "lessThan": "740621309b25bbf619b8a0ba5fd50a8e58989441",
              "status": "affected",
              "version": "8a7ae055f3533b520401c170ac55e30628b34df5",
              "versionType": "git"
            },
            {
              "lessThan": "361ce3b917aff93123e9e966d8608655c967f438",
              "status": "affected",
              "version": "8a7ae055f3533b520401c170ac55e30628b34df5",
              "versionType": "git"
            },
            {
              "lessThan": "22b87fb17a28d37331bb9c1110737627b17f6781",
              "status": "affected",
              "version": "8a7ae055f3533b520401c170ac55e30628b34df5",
              "versionType": "git"
            },
            {
              "lessThan": "bff1fbf0cf0712686f1df59a83fba6e31d2746a0",
              "status": "affected",
              "version": "8a7ae055f3533b520401c170ac55e30628b34df5",
              "versionType": "git"
            },
            {
              "lessThan": "7af299b97734c7e7f465b42a2139ce4d77246975",
              "status": "affected",
              "version": "8a7ae055f3533b520401c170ac55e30628b34df5",
              "versionType": "git"
            },
            {
              "lessThan": "ed0e2a893092c7fcb4ff7ba74e5efce53a6f5940",
              "status": "affected",
              "version": "8a7ae055f3533b520401c170ac55e30628b34df5",
              "versionType": "git"
            },
            {
              "lessThan": "da27a83fd6cc7780fea190e1f5c19e87019da65c",
              "status": "affected",
              "version": "8a7ae055f3533b520401c170ac55e30628b34df5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/kvm_host.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.25"
            },
            {
              "lessThan": "2.6.25",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.4.*",
              "status": "unaffected",
              "version": "4.4.273",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.9.*",
              "status": "unaffected",
              "version": "4.9.273",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.237",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.195",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.126",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.12.*",
              "status": "unaffected",
              "version": "5.12.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.4.273",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.9.273",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.237",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.195",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.126",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.44",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.12.11",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.13",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nkvm: avoid speculation-based attacks from out-of-range memslot accesses\n\nKVM\u0027s mechanism for accessing guest memory translates a guest physical\naddress (gpa) to a host virtual address using the right-shifted gpa\n(also known as gfn) and a struct kvm_memory_slot.  The translation is\nperformed in __gfn_to_hva_memslot using the following formula:\n\n      hva = slot-\u003euserspace_addr + (gfn - slot-\u003ebase_gfn) * PAGE_SIZE\n\nIt is expected that gfn falls within the boundaries of the guest\u0027s\nphysical memory.  However, a guest can access invalid physical addresses\nin such a way that the gfn is invalid.\n\n__gfn_to_hva_memslot is called from kvm_vcpu_gfn_to_hva_prot, which first\nretrieves a memslot through __gfn_to_memslot.  While __gfn_to_memslot\ndoes check that the gfn falls within the boundaries of the guest\u0027s\nphysical memory or not, a CPU can speculate the result of the check and\ncontinue execution speculatively using an illegal gfn. The speculation\ncan result in calculating an out-of-bounds hva.  If the resulting host\nvirtual address is used to load another guest physical address, this\nis effectively a Spectre gadget consisting of two consecutive reads,\nthe second of which is data dependent on the first.\n\nRight now it\u0027s not clear if there are any cases in which this is\nexploitable.  One interesting case was reported by the original author\nof this patch, and involves visiting guest page tables on x86.  Right\nnow these are not vulnerable because the hva read goes through get_user(),\nwhich contains an LFENCE speculation barrier.  However, there are\npatches in progress for x86 uaccess.h to mask kernel addresses instead of\nusing LFENCE; once these land, a guest could use speculation to read\nfrom the VMM\u0027s ring 3 address space.  Other architectures such as ARM\nalready use the address masking method, and would be susceptible to\nthis same kind of data-dependent access gadgets.  Therefore, this patch\nproactively protects from these attacks by masking out-of-bounds gfns\nin __gfn_to_hva_memslot, which blocks speculation of invalid hvas.\n\nSean Christopherson noted that this patch does not cover\nkvm_read_guest_offset_cached.  This however is limited to a few bytes\npast the end of the cache, and therefore it is unlikely to be useful in\nthe context of building a chain of data dependent accesses."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T13:51:23.925Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3098b86390a6b9ea52657689f08410baf130ceff"
        },
        {
          "url": "https://git.kernel.org/stable/c/740621309b25bbf619b8a0ba5fd50a8e58989441"
        },
        {
          "url": "https://git.kernel.org/stable/c/361ce3b917aff93123e9e966d8608655c967f438"
        },
        {
          "url": "https://git.kernel.org/stable/c/22b87fb17a28d37331bb9c1110737627b17f6781"
        },
        {
          "url": "https://git.kernel.org/stable/c/bff1fbf0cf0712686f1df59a83fba6e31d2746a0"
        },
        {
          "url": "https://git.kernel.org/stable/c/7af299b97734c7e7f465b42a2139ce4d77246975"
        },
        {
          "url": "https://git.kernel.org/stable/c/ed0e2a893092c7fcb4ff7ba74e5efce53a6f5940"
        },
        {
          "url": "https://git.kernel.org/stable/c/da27a83fd6cc7780fea190e1f5c19e87019da65c"
        }
      ],
      "title": "kvm: avoid speculation-based attacks from out-of-range memslot accesses",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47277",
    "datePublished": "2024-05-21T14:20:04.660Z",
    "dateReserved": "2024-05-21T13:27:52.128Z",
    "dateUpdated": "2026-05-11T13:51:23.925Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

EUVD-2026-309638

CVE-2021-47277 (GCVE-0-2021-47277)

Tags

Sightings

Nomenclature

Related by attack behaviour