CVE-2021-4440— x86/xen: Drop USERGS_SYSRET64 paravirt call
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2021-4440
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
x86/xen: Drop USERGS_SYSRET64 paravirt call
Source: NVD (National Vulnerability Database)
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: x86/xen: Drop USERGS_SYSRET64 paravirt call commit afd30525a659ac0ae0904f0cb4a2ca75522c3123 upstream. USERGS_SYSRET64 is used to return from a syscall via SYSRET, but a Xen PV guest will nevertheless use the IRET hypercall, as there is no sysret PV hypercall defined. So instead of testing all the prerequisites for doing a sysret and then mangling the stack for Xen PV again for doing an iret just use the iret exit from the beginning. This can easily be done via an ALTERNATIVE like it is done for the sysenter compat case already. It should be noted that this drops the optimization in Xen for not restoring a few registers when returning to user mode, but it seems as if the saved instructions in the kernel more than compensate for this drop (a kernel build in a Xen PV guest was slightly faster with this patch applied). While at it remove the stale sysret32 remnants. [ pawan: Brad Spengler and Salvatore Bonaccorso <carnil@debian.org> reported a problem with the 5.10 backport commit edc702b4a820 ("x86/entry_64: Add VERW just before userspace transition"). When CONFIG_PARAVIRT_XXL=y, CLEAR_CPU_BUFFERS is not executed in syscall_return_via_sysret path as USERGS_SYSRET64 is runtime patched to: .cpu_usergs_sysret64 = { 0x0f, 0x01, 0xf8, 0x48, 0x0f, 0x07 }, // swapgs; sysretq which is missing CLEAR_CPU_BUFFERS. It turns out dropping USERGS_SYSRET64 simplifies the code, allowing CLEAR_CPU_BUFFERS to be explicitly added to syscall_return_via_sysret path. Below is with CONFIG_PARAVIRT_XXL=y and this patch applied: syscall_return_via_sysret: ... <+342>: swapgs <+345>: xchg %ax,%ax <+347>: verw -0x1a2(%rip) <------ <+354>: sysretq ]
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Linux kernel安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于x86/xen USERGS_SYSRET64中存在安全问题。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2021-4440
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-4440
请登录查看更多情报信息。
Same Patch Batch · Linux · 2024-06-25 · 24 CVEs total
| CVE-2024-39371 | io_uring: check for non-NULL file pointer in io_file_can_poll() | |
| CVE-2024-39471 | drm/amdgpu: add error handle to avoid out-of-bounds | |
| CVE-2024-39469 | nilfs2: fix nilfs_empty_dir() misjudgment and long loop on I/O errors | |
| CVE-2024-39470 | eventfs: Fix a possible null pointer dereference in eventfs_find_events() | |
| CVE-2024-39468 | smb: client: fix deadlock in smb2_find_smb_tcon() | |
| CVE-2024-39467 | f2fs: fix to do sanity check on i_xattr_nid in sanity_check_inode() | |
| CVE-2024-39466 | thermal/drivers/qcom/lmh: Check for SCM availability at probe | |
| CVE-2024-39464 | media: v4l: async: Fix notifier list entry init | |
| CVE-2024-39465 | media: mgb4: Fix double debugfs remove | |
| CVE-2024-39463 | 9p: add missing locking around taking dentry fid list | |
| CVE-2024-39462 | clk: bcm: dvp: Assign ->num before accessing ->hws | |
| CVE-2024-39461 | clk: bcm: rpi: Assign ->num before accessing ->hws | |
| CVE-2022-48772 | media: lgdt3306a: Add a check against null-pointer-def | |
| CVE-2024-39301 | net/9p: fix uninit-value in p9_client_rpc() | |
| CVE-2024-39298 | mm/memory-failure: fix handling of dissolved but not taken off from buddy pages | |
| CVE-2024-39296 | bonding: fix oops during rmmod | |
| CVE-2024-39293 | Revert "xsk: Support redirect to any socket bound to the same umem" | |
| CVE-2024-39276 | ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find() | |
| CVE-2024-38661 | s390/ap: Fix crash in AP internal function modify_bitmap() | |
| CVE-2024-38385 | genirq/irqdesc: Prevent use-after-free in irq_find_at_or_after() |
Showing top 20 of 24 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
- CVE-2026-43500
rxrpc: Also unshare DATA/RESPONSE packets when paged frags a - CVE-2026-43475
scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT - CVE-2026-43474
fs: init flags_valid before calling vfs_fileattr_get - CVE-2026-43473
scsi: mpi3mr: Add NULL checks when resetting request and rep - CVE-2026-43472
unshare: fix unshare_fs() handling
Same vendor: Linux
- CVE-2026-43500
rxrpc: Also unshare DATA/RESPONSE packets when paged frags a - CVE-2026-43475
scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT - CVE-2026-43474
fs: init flags_valid before calling vfs_fileattr_get - CVE-2026-43473
scsi: mpi3mr: Add NULL checks when resetting request and rep - CVE-2026-43472
unshare: fix unshare_fs() handling
V. Comments for CVE-2021-4440
No comments yet