CVE-2021-47390

What it actually does

Stack out-of-bounds read in kvm_make_vcpus_request_mask triggered by ioapic_write_indirect due to vcpu_bitmap sized as a single long instead of KVM_MAX_VCPUS, allowing adjacent stack memory to be accessed.

Why it matters to the business

Virtualization hosts running affected kernels risk crashes, denial of service, or potential memory disclosure when untrusted guests interact with emulated IOAPIC hardware, impacting availability of VMs and hypervisor stability.

How an attack unfolds

An attacker controlling a guest VM issues crafted IOAPIC indirect writes that reach kvm_make_scan_ioapic_request_mask, causing the undersized stack bitmap to be read beyond its bounds during vCPU request masking.

How to fix it

Update the Linux kernel to a version containing the fix for this stack sizing error in kvm_make_vcpus_request_mask; rebuild and reboot host systems after applying the patch.

How to confirm the fix worked

Confirm the vcpu_bitmap declaration size matches KVM_MAX_VCPUS and that bitmap_zero calls no longer truncate the structure; run KASAN-enabled kernels with IOAPIC stress tests to verify absence of out-of-bounds reports.

Typical attack path

1. Attacker gains code execution or control inside a guest VM
2. Guest performs IOAPIC register writes that invoke ioapic_write_indirect
3. ioapic_write_indirect calls kvm_make_scan_ioapic_request_mask with malicious parameters
4. kvm_make_vcpus_request_mask performs out-of-bounds stack read on the undersized bitmap
5. Kernel triggers KASAN report, potential crash or information leak

How to detect it

Search kernel logs for KASAN stack-out-of-bounds reports mentioning kvm_make_vcpus_request_mask or ioapic_write_indirect; inspect guest IOAPIC register access patterns in hypervisor traces for anomalous indirect writes.

What your security team should do

• Prioritize kernel updates on all KVM hosts within standard change windows
• Monitor vendor advisories for backported fixes in supported distributions
• Restrict untrusted guest access to IOAPIC emulation where possible via VM configuration
• Enable kernel hardening features such as KASAN in test environments to catch similar issues