Security readout for executives and security teams
Plain-English summary
CVE-2021-47230 is a Linux KVM x86 bug where a virtual CPU can leave memory-management state inconsistent after an SMM exit failure. The documented failure path can trigger a kernel NULL pointer dereference, causing high availability impact and possible integrity impact on affected virtualization hosts.
Executive priority
Schedule remediation through normal kernel patch cycles, faster for shared or tenant-facing virtualization hosts. There is no cited active exploitation, but a host kernel crash path in KVM can affect service availability and virtualization trust boundaries.
Technical view
KVM failed to immediately reset the MMU context when the vCPU SMM flag was cleared. If RSM handling failed before post_leave_smm(), MMU role state could keep SMM=1 while the vCPU had SMM=0, causing mismatched memslot/rmap lookups and a NULL pointer dereference during page fault handling.
Likely exposure
Exposure is most relevant to x86 Linux systems using KVM virtualization on affected kernel builds. The bundle identifies Linux kernel versions and stable fixes, but exact exposure depends on distribution backports and whether untrusted users or guests can exercise KVM paths.
Exploitation context
The CVSS vector is local, low complexity, low privilege, with user interaction required. The bundle does not identify public exploitation, and KEV is false. Treat this as a denial-of-service and integrity-risk issue for virtualization hosts rather than confirmed active exploitation.
Researcher notes
Key root cause is MMU role desynchronization after SMM flag clearing when RSM fails. The source bundle’s affected-version data is incomplete for distribution kernels; validate with actual vendor kernel changelogs or backport metadata before declaring systems vulnerable or fixed.
Mitigation direction
- Update affected Linux kernels to vendor-supported builds containing the referenced KVM fixes.
- Check distribution advisories for backported fixes matching the kernel in production.
- Restrict KVM access to trusted users and controlled virtualization workloads.
- Prioritize hosts running untrusted guests or shared virtualization services.
- Monitor kernel logs for KVM MMU, SMM, page fault, or NULL dereference crashes.
Validation and detection
- Inventory x86 Linux hosts with KVM enabled and record running kernel versions.
- Compare installed kernels against vendor advisories and the referenced stable commits.
- Confirm fixed packages are installed and active after reboot.
- Review access controls for /dev/kvm and virtualization management interfaces.
- Check crash logs for the described gfn_to_rmap or KVM MMU fault path.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-476: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-47230 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.6 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H1.35.2CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
6.6MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/cbb425f62df9df7abee4b3f068f7ed6ffc3561e2CVE reference, Linux
- https://git.kernel.org/stable/c/669a8866e468fd020d34eb00e08cb41d3774b71bCVE reference, Linux
- https://git.kernel.org/stable/c/df9a40cfb3be2cbeb1c17bb67c59251ba16630f3CVE reference, Linux
- https://git.kernel.org/stable/c/78fcb2c91adfec8ce3a2ba6b4d0dda89f2f4a7c6CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
NULL Pointer Dereference
NULL Pointer Dereference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.