LiveActive security incident?Get immediate response
CVE Record

CVE-2021-47228: x86/ioremap: Map EFI-reserved memory as encrypted for SEV

In the Linux kernel, the following vulnerability has been resolved: x86/ioremap: Map EFI-reserved memory as encrypted for SEV Some drivers require memory that is marked as EFI boot services data. In order for this memory to not be re-used by the kernel after ExitBootServices(), efi_mem_reserve() is used to preserve it by inserting a new EFI memory descriptor and marking it with the EFI_MEMORY_RUNTIME attribute. Under SEV, memory marked with the EFI_MEMORY_RUNTIME attribute needs to be mapped encrypted by Linux, otherwise the kernel might crash at boot like below: EFI Variables Facility v0.08 2004-May-17 general protection fault, probably for non-canonical address 0x3597688770a868b2: 0000 [#1] SMP NOPTI CPU: 13 PID: 1 Comm: swapper/0 Not tainted 5.12.4-2-default #1 openSUSE Tumbleweed Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:efi_mokvar_entry_next [...] Call Trace: efi_mokvar_sysfs_init ? efi_mokvar_table_init do_one_initcall ? __kmalloc kernel_init_freeable ? rest_init kernel_init ret_from_fork Expand the __ioremap_check_other() function to additionally check for this other type of boot data reserved at runtime and indicate that it should be mapped encrypted for an SEV guest. [ bp: Massage commit message. ]

MediumCVSS 6.2Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

A Linux boot-time handling issue affects encrypted AMD SEV guest systems. EFI-reserved memory could be mapped incorrectly, causing the kernel to crash during boot. The main business impact is availability loss for affected virtual machines, not data theft or remote compromise.

Executive priority

Treat as a targeted availability risk for encrypted VM environments. It deserves prompt patch planning where AMD SEV is used, especially for production guests, but the provided evidence does not support emergency remote-exploitation response.

Technical view

On x86 under SEV, Linux did not always map EFI boot-services data reserved with EFI_MEMORY_RUNTIME as encrypted. Drivers using efi_mem_reserve could leave reserved runtime EFI memory mapped with the wrong encryption attribute, triggering a general protection fault during EFI variable initialization.

Likely exposure

Exposure appears limited to Linux x86 systems running as AMD SEV guests on affected kernel versions or unpatched downstream builds. Non-SEV systems are unlikely to match the described failure mode. Exact exposure should be confirmed against vendor kernel backports.

Exploitation context

The provided sources do not report active exploitation, public exploit code, or CISA KEV listing. The CVSS vector is local availability impact, and the described symptom is a boot crash in specific SEV and EFI runtime-memory conditions.

Researcher notes

Focus validation on x86 SEV guests, EFI runtime memory descriptors, and efi_mem_reserve paths. The fix expands __ioremap_check_other() so EFI runtime-reserved boot-services data is mapped encrypted. Evidence is incomplete for distro-specific affected ranges.

Mitigation direction

  • Apply Linux kernel updates containing the referenced stable fixes.
  • Confirm downstream distribution packages include the relevant backports.
  • Prioritize affected SEV guest images used in production or recovery workflows.
  • Check vendor advisories for exact fixed package versions.
  • Avoid direct deploy shortcuts; follow normal tested kernel rollout procedures.

Validation and detection

  • Inventory Linux kernels running as AMD SEV guests.
  • Compare kernel builds against vendor-fixed versions or referenced stable commits.
  • Review boot logs for EFI variable initialization crashes or general protection faults.
  • Test patched images in SEV-enabled staging before production rollout.
  • Verify critical VM recovery images also use fixed kernels.
Prepared
Confidence
high
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-47228 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
6.2 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
2ADP providers
4Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
6.2CVSS 3.1MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H2.53.6CISA-ADP

Vulnerability scoring details

Base CVSS 3.1 score

6.2Medium
CVSS 3.1 vector shape for CVE-2021-47228Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
cvssV3_1other:ssvc
CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux58c909022a5a56cd1d9e89c8c5461fd1f6a27bb5, 58c909022a5a56cd1d9e89c8c5461fd1f6a27bb5, 58c909022a5a56cd1d9e89c8c5461fd1f6a27bb5unaffected
LinuxLinux5.10, 0, 5.10.46, 5.12.13, 5.13affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.