CVE-2021-47277

A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem. A malicious guest could exploit this vulnerability to cause information disclosure through speculative execution side-channel attacks. During guest-to-host memory address translation, an attacker can access out-of-bounds memory slots that the processor speculatively evaluates before boundary validation completes, potentially exposing sensitive host memory.

This vulnerability is rated as Moderate severity because it requires an attacker to already possess privileged code execution within a virtual machine to attempt speculative side-channel attacks against the host. Systems that do not host untrusted KVM guest instances or do not run virtualized workloads are not exposed to this issue. Additionally, successful exploitation depends on complex timing conditions across virtualization boundaries and specific microarchitectural behavior to leak host memory.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.