CVE-2021-47255

What it actually does

Missing guard in kvm_lapic_reg_read permits reads touching bytes 4-15 of APIC registers, resulting in out-of-bounds kernel stack memory disclosure.

Why it matters to the business

Low-probability information leak in virtualized Linux environments; older unpatched kernels retain exposure but widespread impact is limited by low exploitability and long publication window.

How an attack unfolds

An attacker able to issue APIC register accesses to a vulnerable KVM instance supplies an illegal offset that bypasses prior validation, causing the read path to return adjacent kernel stack bytes.

How to fix it

Upgrade to a Linux kernel containing the restored APIC access guard; apply distribution backports that reintroduce the check removed by commit 01402cf81051.

How to confirm the fix worked

Confirm presence of the bounds check guarding bytes 4-15 in kvm_lapic_reg_read; attempt synthetic illegal APIC reads in a test VM and verify no stack leakage occurs.

Typical attack path

1. Locate Linux host running vulnerable KVM
2. Obtain interface access to LAPIC register space
3. Issue read touching disallowed APIC register bytes
4. Capture and parse leaked kernel stack contents

How to detect it

Review kernel audit logs and hypervisor traces for anomalous APIC register operations; inspect guest-to-host communication channels for unexpected read patterns.

What your security team should do

• Inventory all Linux hosts using KVM
• Schedule kernel updates for affected systems
• Harden guest-hypervisor interfaces where KVM is enabled