CVE-2021-4093: canonical ubuntu_linux Out-of-bounds Read

Vulnerability summary

CVE-2021-4093 is a high (CVSS 8.8) Out-of-bounds Read vulnerability in canonical ubuntu_linux. EPSS estimates a 0.42% chance of exploitation in the next 30 days, higher than 36.2% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 18-02-2022
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

A flaw was found in the KVM's AMD code for supporting the Secure Encrypted Virtualization-Encrypted State (SEV-ES). A KVM guest using SEV-ES can trigger out-of-bounds reads and writes in the host kernel via a malicious VMGEXIT for a string I/O instruction (for example, outs or ins) using the exit reason SVM_EXIT_IOIO. This issue results in a crash of the entire system or a potential guest-to-host escape scenario.

• CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.
• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.