CVE-2021-47008

What it actually does

NULL pointer dereference when sev_vcpu_deliver_sipi_vector or svm_complete_emulated_msr updates the GHCB without first verifying it is mapped in the KVM SVM SEV path.

Why it matters to the business

Guest-triggered kernel panic on AMD SEV hosts can cause denial of service for virtual machines and require host restarts, affecting availability of workloads running on affected Linux kernels.

How an attack unfolds

An attacker with control of a guest VM triggers either an AP Reset Hold SIPI delivery without prior VMEXIT mapping or an emulated RDMSR/WRMSR operation that reaches the GHCB update path; because the GHCB pointer is NULL the kernel dereferences it and crashes.

How to fix it

Apply the upstream fix that adds GHCB mapping checks before the updates in sev_vcpu_deliver_sipi_vector and svm_complete_emulated_msr; reboot hosts after installing the patched kernel.

How to confirm the fix worked

Confirm the presence of the mapping guard before the GHCB write in both functions by inspecting the patched KVM SVM source or the corresponding kernel binary; test that the two code paths no longer dereference a NULL GHCB pointer under synthetic SIPI and MSR emulation workloads.

Typical attack path

1. Obtain code execution or control inside a guest VM on an AMD SEV-enabled KVM host
2. Issue SIPI or RDMSR/WRMSR sequences that reach the vulnerable paths without a prior VMGEXIT that maps GHCB
3. Trigger the NULL pointer dereference and cause host kernel panic

How to detect it

Search kernel logs for NULL pointer dereference oopses originating from kvm_svm or svm_complete_emulated_msr; correlate with guest VM activity involving SIPI or MSR emulation immediately preceding the crash.

What your security team should do

• Prioritize patching KVM hosts that use AMD SEV
• Monitor EPSS and any new exploit maturity signals given the 965-day publication window
• Consider disabling SEV on non-production hosts until patches are applied