A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMCB (virtual machine control block) provided by the L1 guest to spawn/handle a nested guest (L2). Due to improper validation of the "virt_ext" field, this issue could allow a malicious L1 to disable both VMLOAD/VMSAVE intercepts and VLS (Virtual VMLOAD/VMSAVE) for the L2 guest. As a result, the L2 guest would be allowed to read/write physical pages of the host, resulting in a crash of the entire system, leak of sensitive data or potential guest-to-host escape.
{
"unresolved_ranges": [
{
"extracted_events": [
{
"last_affected": "2.0"
}
],
"cpe": "cpe:2.3:a:redhat:3scale_api_management:2.0:*:*:*:*:*:*:*",
"source": "CPE_FIELD"
},
{
"cpe": "cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:*",
"extracted_events": [
{
"last_affected": "13"
}
],
"source": "CPE_FIELD"
},
{
"extracted_events": [
{
"last_affected": "33"
}
],
"cpe": "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*",
"source": "CPE_FIELD"
},
{
"cpe": "cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*",
"extracted_events": [
{
"last_affected": "34"
}
],
"source": "CPE_FIELD"
},
{
"cpe": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"extracted_events": [
{
"introduced": "4.13"
},
{
"fixed": "4.14.245"
},
{
"introduced": "4.15"
},
{
"fixed": "4.19.205"
},
{
"introduced": "4.20"
},
{
"fixed": "5.4.142"
},
{
"introduced": "5.5"
},
{
"fixed": "5.10.60"
},
{
"introduced": "5.11"
},
{
"fixed": "5.13.12"
}
],
"source": "CPE_FIELD"
},
{
"cpe": "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*",
"extracted_events": [
{
"last_affected": "8.0"
}
],
"source": "CPE_FIELD"
},
{
"cpe": "cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:*",
"extracted_events": [
{
"last_affected": "8.1"
}
],
"source": "CPE_FIELD"
},
{
"cpe": "cpe:2.3:o:redhat:enterprise_linux_eus:8.2:*:*:*:*:*:*:*",
"extracted_events": [
{
"last_affected": "8.2"
}
],
"source": "CPE_FIELD"
},
{
"extracted_events": [
{
"last_affected": "8.4"
}
],
"cpe": "cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:*",
"source": "CPE_FIELD"
},
{
"cpe": "cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0:*:*:*:*:*:*:*",
"extracted_events": [
{
"last_affected": "8.0"
}
],
"source": "CPE_FIELD"
},
{
"cpe": "cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.1:*:*:*:*:*:*:*",
"extracted_events": [
{
"last_affected": "8.1"
}
],
"source": "CPE_FIELD"
},
{
"extracted_events": [
{
"last_affected": "8.2"
}
],
"cpe": "cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.2:*:*:*:*:*:*:*",
"source": "CPE_FIELD"
},
{
"extracted_events": [
{
"last_affected": "8.4"
}
],
"cpe": "cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.4:*:*:*:*:*:*:*",
"source": "CPE_FIELD"
},
{
"extracted_events": [
{
"last_affected": "8.0"
}
],
"cpe": "cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:*:*:*:*:*:*:*",
"source": "CPE_FIELD"
},
{
"extracted_events": [
{
"last_affected": "8.1"
}
],
"cpe": "cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.1:*:*:*:*:*:*:*",
"source": "CPE_FIELD"
},
{
"cpe": "cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.2:*:*:*:*:*:*:*",
"extracted_events": [
{
"last_affected": "8.2"
}
],
"source": "CPE_FIELD"
},
{
"cpe": "cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.4:*:*:*:*:*:*:*",
"extracted_events": [
{
"last_affected": "8.4"
}
],
"source": "CPE_FIELD"
},
{
"extracted_events": [
{
"last_affected": "8"
}
],
"cpe": "cpe:2.3:o:redhat:enterprise_linux_for_real_time:8:*:*:*:*:*:*:*",
"source": "CPE_FIELD"
},
{
"extracted_events": [
{
"last_affected": "8"
}
],
"cpe": "cpe:2.3:o:redhat:enterprise_linux_for_real_time_for_nfv:8:*:*:*:*:*:*:*",
"source": "CPE_FIELD"
},
{
"cpe": "cpe:2.3:o:redhat:enterprise_linux_for_real_time_for_nfv_tus:8.2:*:*:*:*:*:*:*",
"extracted_events": [
{
"last_affected": "8.2"
}
],
"source": "CPE_FIELD"
},
{
"cpe": "cpe:2.3:o:redhat:enterprise_linux_for_real_time_for_nfv_tus:8.4:*:*:*:*:*:*:*",
"extracted_events": [
{
"last_affected": "8.4"
}
],
"source": "CPE_FIELD"
},
{
"cpe": "cpe:2.3:o:redhat:enterprise_linux_for_real_time_tus:8.2:*:*:*:*:*:*:*",
"extracted_events": [
{
"last_affected": "8.2"
}
],
"source": "CPE_FIELD"
},
{
"extracted_events": [
{
"last_affected": "8.4"
}
],
"cpe": "cpe:2.3:o:redhat:enterprise_linux_for_real_time_tus:8.4:*:*:*:*:*:*:*",
"source": "CPE_FIELD"
},
{
"cpe": "cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*",
"extracted_events": [
{
"last_affected": "7.6"
}
],
"source": "CPE_FIELD"
},
{
"extracted_events": [
{
"last_affected": "7.7"
}
],
"cpe": "cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*",
"source": "CPE_FIELD"
},
{
"cpe": "cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:*",
"extracted_events": [
{
"last_affected": "8.2"
}
],
"source": "CPE_FIELD"
},
{
"cpe": "cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:*",
"extracted_events": [
{
"last_affected": "8.4"
}
],
"source": "CPE_FIELD"
},
{
"cpe": "cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:7.6:*:*:*:*:*:*:*",
"extracted_events": [
{
"last_affected": "7.6"
}
],
"source": "CPE_FIELD"
},
{
"cpe": "cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.1:*:*:*:*:*:*:*",
"extracted_events": [
{
"last_affected": "8.1"
}
],
"source": "CPE_FIELD"
},
{
"cpe": "cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.2:*:*:*:*:*:*:*",
"extracted_events": [
{
"last_affected": "8.2"
}
],
"source": "CPE_FIELD"
},
{
"cpe": "cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.4:*:*:*:*:*:*:*",
"extracted_events": [
{
"last_affected": "8.4"
}
],
"source": "CPE_FIELD"
},
{
"cpe": "cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*",
"extracted_events": [
{
"last_affected": "7.6"
}
],
"source": "CPE_FIELD"
},
{
"cpe": "cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*",
"extracted_events": [
{
"last_affected": "7.7"
}
],
"source": "CPE_FIELD"
},
{
"cpe": "cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:*",
"extracted_events": [
{
"last_affected": "8.2"
}
],
"source": "CPE_FIELD"
},
{
"cpe": "cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:*",
"extracted_events": [
{
"last_affected": "8.4"
}
],
"source": "CPE_FIELD"
},
{
"cpe": "cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:7.6:*:*:*:*:*:*:*",
"extracted_events": [
{
"last_affected": "7.6"
}
],
"source": "CPE_FIELD"
},
{
"cpe": "cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:7.7:*:*:*:*:*:*:*",
"extracted_events": [
{
"last_affected": "7.7"
}
],
"source": "CPE_FIELD"
},
{
"cpe": "cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.1:*:*:*:*:*:*:*",
"extracted_events": [
{
"last_affected": "8.1"
}
],
"source": "CPE_FIELD"
},
{
"cpe": "cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.2:*:*:*:*:*:*:*",
"extracted_events": [
{
"last_affected": "8.2"
}
],
"source": "CPE_FIELD"
},
{
"cpe": "cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.4:*:*:*:*:*:*:*",
"extracted_events": [
{
"last_affected": "8.4"
}
],
"source": "CPE_FIELD"
}
]
}{
"cpe": [
"cpe:2.3:o:linux:linux_kernel:5.14:-:*:*:*:*:*:*",
"cpe:2.3:o:linux:linux_kernel:5.14:rc1:*:*:*:*:*:*",
"cpe:2.3:o:linux:linux_kernel:5.14:rc2:*:*:*:*:*:*",
"cpe:2.3:o:linux:linux_kernel:5.14:rc3:*:*:*:*:*:*",
"cpe:2.3:o:linux:linux_kernel:5.14:rc4:*:*:*:*:*:*",
"cpe:2.3:o:linux:linux_kernel:5.14:rc5:*:*:*:*:*:*",
"cpe:2.3:o:linux:linux_kernel:5.14:rc6:*:*:*:*:*:*",
"cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*",
"cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.0:*:*:*:*:*:*:*",
"cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:7.0:*:*:*:*:*:*:*",
"cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:7.0:*:*:*:*:*:*:*",
"cpe:2.3:o:redhat:enterprise_linux_for_real_time:7:*:*:*:*:*:*:*",
"cpe:2.3:o:redhat:enterprise_linux_for_real_time_for_nfv:7:*:*:*:*:*:*:*",
"cpe:2.3:o:redhat:enterprise_linux_for_scientific_computing:7.0:*:*:*:*:*:*:*",
"cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*",
"cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*",
"cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:*"
],
"extracted_events": [
{
"introduced": "0"
},
{
"last_affected": "5.14-NA"
},
{
"last_affected": "5.14-rc1"
},
{
"last_affected": "5.14-rc2"
},
{
"last_affected": "5.14-rc3"
},
{
"last_affected": "5.14-rc4"
},
{
"last_affected": "5.14-rc5"
},
{
"last_affected": "5.14-rc6"
},
{
"last_affected": "7.0"
},
{
"last_affected": "7"
},
{
"last_affected": "4.0"
}
],
"source": "CPE_FIELD"
}