CVE-2021-47062

    Dashboard / Vulnerabilities / CVE-2021-47062

    CVE-2021-47062

    Published: 29 Feb 2024Last Modified: 10 Mar 2026

    Summary:

    Details: In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Use online_vcpus, not created_vcpus, to iterate over vCPUs Use the kvm_for_each_vcpu() helper to iterate over vCPUs when encrypting VMSAs for SEV, which effectively switches to use online_vcpus instead of created_vcpus. This fixes a possible null-pointer dereference as created_vcpus does not guarantee a vCPU exists, since it is updated at the very beginning of KVM_CREATE_VCPU. created_vcpus exists to allow the bulk of vCPU creation to run in parallel, while still correctly restricting the max number of max vCPUs.

    References: , https://git.kernel.org/stable/c/ba7bf5d6336aa9c0d977b161bfa420c56d46ee40, https://git.kernel.org/stable/c/bd0cced2ae93195668f983d443f7f17e8efd24d2, https://git.kernel.org/stable/c/c36b16d29f3af5f32fc1b2a3401bf48f71cabee1

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-47062 | CVE-DB