CVE-2021-47227

What it actually does

Allows invalid XSAVE state from user space to be copied verbatim into the kernel XSAVE buffer in the non-compacted slowpath of __fpu__restore_sig(), bypassing full header validation and enabling XRSTOR #GP faults or kernel state corruption on x86 systems.

Why it matters to the business

May cause kernel panics, system instability, or denial of service on x86 Linux hosts during routine signal handling involving FPU state, increasing operational risk for workloads relying on the affected kernels.

How an attack unfolds

An attacker prepares a malformed user-space XSAVE buffer and forces delivery of a signal that invokes the vulnerable non-compacted restore path; the kernel copies the invalid state without proper validation, leading to faults or corruption when XRSTOR executes.

How to fix it

Upgrade to a Linux kernel containing the fix that routes both compacted and non-compacted restore paths through copy_user_to_xstate() before any XRSTOR operation.

How to confirm the fix worked

Confirm the patched kernel source uses copy_user_to_xstate() for non-compacted buffers in __fpu__restore_sig(); exercise the function with intentionally invalid user-state headers and verify no #GP or corruption occurs.

Typical attack path

1. Prepare malformed XSAVE header and state in user-space memory
2. Trigger signal delivery that reaches __fpu__restore_sig() slowpath
3. Kernel performs unchecked __copy_from_user() into XSAVE buffer
4. XRSTOR encounters invalid state and generates #GP or corrupts supervisor state

How to detect it

Search kernel logs for XRSTOR #GP faults or FPU state corruption messages during signal handling; examine crash dumps for corrupted XSAVE buffers in the restore path.

What your security team should do

• Prioritize kernel updates on all x86 systems
• Include FPU/XSAVE-related kernel oops in crash-monitoring rules
• Audit custom or downstream kernels for equivalent FPU restore changes