CVE-2021-46967

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2021-46967", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-27T18:42:55.943Z", "datePublished": "2024-02-27T18:47:04.253Z", "dateUpdated": "2026-08-05T08:45:17.104Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:45:17.104Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvhost-vdpa: fix vm_flags for virtqueue doorbell mapping\n\nThe virtqueue doorbell is usually implemented via registeres but we\ndon't provide the necessary vma->flags like VM_PFNMAP. This may cause\nseveral issues e.g when userspace tries to map the doorbell via vhost\nIOTLB, kernel may panic due to the page is not backed by page\nstructure. This patch fixes this by setting the necessary\nvm_flags. With this patch, try to map doorbell via IOTLB will fail\nwith bad address."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached only via local open/mmap/ioctl on `/dev/vhost-vdpa-N` (mmap of the virtqueue doorbell, then a vhost IOTLB update on that uaddr), not via network packets or adjacent-link protocols.\nAC:L - An attacker who can open the device can deterministically mmap the doorbell and submit a VHOST_IOTLB_UPDATE for that address without depending on races, special memory layout, or other conditions outside their control.\nPR:L - There is no capability check on the open/mmap/IOTLB path; access is gated only by DAC on the vhost-vdpa node, which in standard libvirt/QEMU deployments is held by an unprivileged VMM account (same model as CVE-2024-47748).\nUI:N - The attacker performs the mmap and IOTLB update from their own process; no separate victim action is required.\nS:U - Impact is confined to the host kernel authority that already owns the vhost-vdpa/IOTLB path; this is not a guest-to-host escape or an exploit whose defining effect is crossing an IOMMU/VM boundary.\nC:H - Without VM_PFNMAP, IOTLB pinning of the doorbell can proceed into GUP\u2019s PFNMAP -EEXIST path, which in the affected kernels left page_list entries unset so page_to_pfn/IOMMU map operate on attacker-influenced garbage, enabling arbitrary physical-memory disclosure via bad DMA maps.\nI:H - The same uninitialized-page / wrong-PFN IOTLB install and later pfn_to_page/unpin_user_page teardown provide kernel memory corruption and arbitrary DMA write primitives against host physical memory.\nA:H - The fix explicitly documents that mapping the doorbell via vhost IOTLB can panic the kernel because the page is not backed by a struct page, which is High availability impact."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/vhost/vdpa.c"], "versions": [{"version": "ddd89d0a059d8e9740c75a97e0efe9bf07ee51f9", "lessThan": "3b8b6399666a29daa30b0bb3f5c9e3fc81c5a6a6", "status": "affected", "versionType": "git"}, {"version": "ddd89d0a059d8e9740c75a97e0efe9bf07ee51f9", "lessThan": "940230a5c31e2714722aee04c521a21f484b4df7", "status": "affected", "versionType": "git"}, {"version": "ddd89d0a059d8e9740c75a97e0efe9bf07ee51f9", "lessThan": "93dbbf20e3ffad14f04227a0b7105f6e6f0387ce", "status": "affected", "versionType": "git"}, {"version": "ddd89d0a059d8e9740c75a97e0efe9bf07ee51f9", "lessThan": "3a3e0fad16d40a2aa68ddf7eea4acdf48b22dd44", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/vhost/vdpa.c"], "versions": [{"version": "5.8", "status": "affected"}, {"version": "0", "lessThan": "5.8", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.36", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.11.20", "lessThanOrEqual": "5.11.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.12.3", "lessThanOrEqual": "5.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.13", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "5.10.36"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "5.11.20"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "5.12.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "5.13"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3b8b6399666a29daa30b0bb3f5c9e3fc81c5a6a6"}, {"url": "https://git.kernel.org/stable/c/940230a5c31e2714722aee04c521a21f484b4df7"}, {"url": "https://git.kernel.org/stable/c/93dbbf20e3ffad14f04227a0b7105f6e6f0387ce"}, {"url": "https://git.kernel.org/stable/c/3a3e0fad16d40a2aa68ddf7eea4acdf48b22dd44"}], "title": "vhost-vdpa: fix vm_flags for virtqueue doorbell mapping", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-46967", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-02-27T19:32:37.039372Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:13:04.232Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:17:43.025Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/3b8b6399666a29daa30b0bb3f5c9e3fc81c5a6a6", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/940230a5c31e2714722aee04c521a21f484b4df7", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/93dbbf20e3ffad14f04227a0b7105f6e6f0387ce", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/3a3e0fad16d40a2aa68ddf7eea4acdf48b22dd44", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/3b8b6399666a29daa30b0bb3f5c9e3fc81c5a6a6", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/940230a5c31e2714722aee04c521a21f484b4df7", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/93dbbf20e3ffad14f04227a0b7105f6e6f0387ce", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/3a3e0fad16d40a2aa68ddf7eea4acdf48b22dd44", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:17:43.025Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-46967", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-02-27T19:32:37.039372Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-23T19:01:13.453Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "vhost-vdpa: fix vm_flags for virtqueue doorbell mapping", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached only via local open/mmap/ioctl on `/dev/vhost-vdpa-N` (mmap of the virtqueue doorbell, then a vhost IOTLB update on that uaddr), not via network packets or adjacent-link protocols.\nAC:L - An attacker who can open the device can deterministically mmap the doorbell and submit a VHOST_IOTLB_UPDATE for that address without depending on races, special memory layout, or other conditions outside their control.\nPR:L - There is no capability check on the open/mmap/IOTLB path; access is gated only by DAC on the vhost-vdpa node, which in standard libvirt/QEMU deployments is held by an unprivileged VMM account (same model as CVE-2024-47748).\nUI:N - The attacker performs the mmap and IOTLB update from their own process; no separate victim action is required.\nS:U - Impact is confined to the host kernel authority that already owns the vhost-vdpa/IOTLB path; this is not a guest-to-host escape or an exploit whose defining effect is crossing an IOMMU/VM boundary.\nC:H - Without VM_PFNMAP, IOTLB pinning of the doorbell can proceed into GUP\u2019s PFNMAP -EEXIST path, which in the affected kernels left page_list entries unset so page_to_pfn/IOMMU map operate on attacker-influenced garbage, enabling arbitrary physical-memory disclosure via bad DMA maps.\nI:H - The same uninitialized-page / wrong-PFN IOTLB install and later pfn_to_page/unpin_user_page teardown provide kernel memory corruption and arbitrary DMA write primitives against host physical memory.\nA:H - The fix explicitly documents that mapping the doorbell via vhost IOTLB can panic the kernel because the page is not backed by a struct page, which is High availability impact."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "ddd89d0a059d8e9740c75a97e0efe9bf07ee51f9", "lessThan": "3b8b6399666a29daa30b0bb3f5c9e3fc81c5a6a6", "versionType": "git"}, {"status": "affected", "version": "ddd89d0a059d8e9740c75a97e0efe9bf07ee51f9", "lessThan": "940230a5c31e2714722aee04c521a21f484b4df7", "versionType": "git"}, {"status": "affected", "version": "ddd89d0a059d8e9740c75a97e0efe9bf07ee51f9", "lessThan": "93dbbf20e3ffad14f04227a0b7105f6e6f0387ce", "versionType": "git"}, {"status": "affected", "version": "ddd89d0a059d8e9740c75a97e0efe9bf07ee51f9", "lessThan": "3a3e0fad16d40a2aa68ddf7eea4acdf48b22dd44", "versionType": "git"}], "programFiles": ["drivers/vhost/vdpa.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.8"}, {"status": "unaffected", "version": "0", "lessThan": "5.8", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.36", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.11.20", "versionType": "semver", "lessThanOrEqual": "5.11.*"}, {"status": "unaffected", "version": "5.12.3", "versionType": "semver", "lessThanOrEqual": "5.12.*"}, {"status": "unaffected", "version": "5.13", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/vhost/vdpa.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/3b8b6399666a29daa30b0bb3f5c9e3fc81c5a6a6"}, {"url": "https://git.kernel.org/stable/c/940230a5c31e2714722aee04c521a21f484b4df7"}, {"url": "https://git.kernel.org/stable/c/93dbbf20e3ffad14f04227a0b7105f6e6f0387ce"}, {"url": "https://git.kernel.org/stable/c/3a3e0fad16d40a2aa68ddf7eea4acdf48b22dd44"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvhost-vdpa: fix vm_flags for virtqueue doorbell mapping\n\nThe virtqueue doorbell is usually implemented via registeres but we\ndon't provide the necessary vma->flags like VM_PFNMAP. This may cause\nseveral issues e.g when userspace tries to map the doorbell via vhost\nIOTLB, kernel may panic due to the page is not backed by page\nstructure. This patch fixes this by setting the necessary\nvm_flags. With this patch, try to map doorbell via IOTLB will fail\nwith bad address."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.36", "versionStartIncluding": "5.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.11.20", "versionStartIncluding": "5.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.12.3", "versionStartIncluding": "5.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.13", "versionStartIncluding": "5.8"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:45:17.104Z"}}}, "cveMetadata": {"cveId": "CVE-2021-46967", "state": "PUBLISHED", "dateUpdated": "2026-08-05T08:45:17.104Z", "dateReserved": "2024-02-27T18:42:55.943Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-02-27T18:47:04.253Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/vhost/vdpa.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "3b8b6399666a29daa30b0bb3f5c9e3fc81c5a6a6", "status": "affected", "version": "ddd89d0a059d8e9740c75a97e0efe9bf07ee51f9", "versionType": "git"}, {"lessThan": "940230a5c31e2714722aee04c521a21f484b4df7", "status": "affected", "version": "ddd89d0a059d8e9740c75a97e0efe9bf07ee51f9", "versionType": "git"}, {"lessThan": "93dbbf20e3ffad14f04227a0b7105f6e6f0387ce", "status": "affected", "version": "ddd89d0a059d8e9740c75a97e0efe9bf07ee51f9", "versionType": "git"}, {"lessThan": "3a3e0fad16d40a2aa68ddf7eea4acdf48b22dd44", "status": "affected", "version": "ddd89d0a059d8e9740c75a97e0efe9bf07ee51f9", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/vhost/vdpa.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.8"}, {"lessThan": "5.8", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.36", "versionType": "semver"}, {"lessThanOrEqual": "5.11.*", "status": "unaffected", "version": "5.11.20", "versionType": "semver"}, {"lessThanOrEqual": "5.12.*", "status": "unaffected", "version": "5.12.3", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "5.13", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "4A500519-BED3-4E94-A4DF-98098BF45173", "versionEndExcluding": "5.10.36", "versionStartIncluding": "5.8", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "EEC03413-9760-46D4-AC1D-EB084A1D4111", "versionEndExcluding": "5.11.20", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "F9D6B2DE-7E4A-4B3B-9AEE-3A2C5F23DA32", "versionEndExcluding": "5.12.3", "versionStartIncluding": "5.12", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvhost-vdpa: fix vm_flags for virtqueue doorbell mapping\n\nThe virtqueue doorbell is usually implemented via registeres but we\ndon't provide the necessary vma->flags like VM_PFNMAP. This may cause\nseveral issues e.g when userspace tries to map the doorbell via vhost\nIOTLB, kernel may panic due to the page is not backed by page\nstructure. This patch fixes this by setting the necessary\nvm_flags. With this patch, try to map doorbell via IOTLB will fail\nwith bad address."}, {"lang": "es", "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: vhost-vdpa: corrige vm_flags para el mapeo del timbre virtqueue El timbre virtqueue generalmente se implementa a trav\u00e9s de registros, pero no proporcionamos los vma->flags necesarios como VM_PFNMAP. Esto puede causar varios problemas, por ejemplo, cuando el espacio de usuario intenta asignar el timbre a trav\u00e9s de vhost IOTLB, el kernel puede entrar en p\u00e1nico debido a que la p\u00e1gina no est\u00e1 respaldada por la estructura de la p\u00e1gina. Este parche soluciona este problema configurando los vm_flags necesarios. Con este parche, intentar asignar el timbre a trav\u00e9s de IOTLB fallar\u00e1 con una direcci\u00f3n incorrecta."}], "id": "CVE-2021-46967", "lastModified": "2026-08-04T10:16:38.807", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2021-46967", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-02-27T19:32:37.039372Z", "version": "2.0.3"}}]}, "published": "2024-02-27T19:04:07.170", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3a3e0fad16d40a2aa68ddf7eea4acdf48b22dd44"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3b8b6399666a29daa30b0bb3f5c9e3fc81c5a6a6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/93dbbf20e3ffad14f04227a0b7105f6e6f0387ce"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/940230a5c31e2714722aee04c521a21f484b4df7"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3a3e0fad16d40a2aa68ddf7eea4acdf48b22dd44"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3b8b6399666a29daa30b0bb3f5c9e3fc81c5a6a6"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/93dbbf20e3ffad14f04227a0b7105f6e6f0387ce"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/940230a5c31e2714722aee04c521a21f484b4df7"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: vhost-vdpa: fix vm_flags for virtqueue doorbell mapping", "id": "2266804", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2266804"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-230", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nvhost-vdpa: fix vm_flags for virtqueue doorbell mapping\nThe virtqueue doorbell is usually implemented via registeres but we\ndon't provide the necessary vma->flags like VM_PFNMAP. This may cause\nseveral issues e.g when userspace tries to map the doorbell via vhost\nIOTLB, kernel may panic due to the page is not backed by page\nstructure. This patch fixes this by setting the necessary\nvm_flags. With this patch, try to map doorbell via IOTLB will fail\nwith bad address."], "name": "CVE-2021-46967", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-02-27T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2021-46967\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-46967\nhttps://lore.kernel.org/linux-cve-announce/2024022720-CVE-2021-46967-c991@gregkh/T/#u"], "threat_severity": "Moderate"}

{}