CVE-2021-47110

What it actually does

Failure to disable kvmclock MSR on non-boot CPUs during machine_shutdown leaves hypervisor-updatable clock memory locations active, allowing updates after shutdown begins and resulting in memory corruption on hibernate restore.

Why it matters to the business

Systems using virtualization on affected AlmaLinux kernels risk memory corruption and instability during hibernate or shutdown-restore cycles, with low urgency given the absence from known exploited lists and stable low exploit probability.

How an attack unfolds

An attacker with local access triggers a full system shutdown or hibernate; the incomplete kvmclock disablement on secondary CPUs permits the hypervisor to continue writing clock values, corrupting memory on subsequent restore.

How to fix it

Upgrade the affected sassist package on AlmaLinux 8 to version 0.8.6-1.el8 or later to apply the kvmclock disablement fix across all CPUs.

How to confirm the fix worked

Verify installed package version matches or exceeds the fixed release; confirm kernel source includes the machine_shutdown hook calling kvmclock disablement for every CPU.

Typical attack path

1. Obtain local access on a virtualized x86 system
2. Initiate shutdown or hibernate sequence
3. Exploit the window where kvmclock remains enabled on non-boot CPUs
4. Trigger restore from hibernate to observe or induce memory corruption

How to detect it

Review system logs around shutdown and hibernate events for unexpected memory errors or corruption reports; check for kernel messages referencing kvmclock after shutdown hooks.

What your security team should do

• Apply the package upgrade to 0.8.6-1.el8 immediately on all AlmaLinux 8 virtualization hosts
• Test hibernate and restore cycles in a lab environment post-upgrade
• Monitor for any remaining systems running older sassist versions