CVE-2021-22543: Linux Kernel KVM Privilege Escalation Flaw

CVE-2021-22543 Overview

CVE-2021-22543 is a memory corruption vulnerability in the Linux kernel's Kernel-based Virtual Machine (KVM) subsystem. The flaw stems from improper handling of VM_IO|VM_PFNMAP virtual memory areas (VMAs). KVM fails to enforce read-only (RO) checks correctly, allowing pages to be freed while still accessible by both the Virtual Machine Monitor (VMM) and the guest. Users with the ability to start and control a VM can read or write arbitrary pages of host memory. The vulnerability falls under [CWE-119] improper restriction of operations within memory buffer bounds. Successful exploitation enables local privilege escalation on the host system.

Critical Impact
A local attacker with VM control privileges can read and write arbitrary host memory pages, leading to local privilege escalation on the hypervisor host.

Affected Products

Linux Kernel (versions up to and including the 2021-05-18 build)
Fedora 33 and Fedora 34
Debian Linux 9.0 and related LTS distributions
NetApp HCI compute and storage nodes (H300S/E, H410S/C, H500S/E, H700S/E) and SolidFire Baseboard Management Controller firmware
NetApp Cloud Backup

Discovery Timeline

2021-05-26 - CVE-2021-22543 published to the National Vulnerability Database
2021-07-08 - NetApp publishes security advisory NTAP-20210708-0002
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-22543

Vulnerability Analysis

The vulnerability resides in how KVM maps guest physical addresses to host pages backed by VMAs flagged with VM_IO or VM_PFNMAP. These flags typically indicate memory-mapped I/O regions or raw page frame mappings that the kernel handles differently from normal anonymous or file-backed memory. KVM's page mapping logic does not correctly preserve the read-only attribute when translating these special VMAs into Stage-2 or EPT (Extended Page Table) entries. As a result, the guest can obtain write access to host pages that should be protected. The same logic flaw allows pages to be released back to the kernel page allocator while KVM and the guest still hold references to them, producing a use-after-free condition on host memory.

Root Cause

The root cause is missing or incorrect validation of VMA flags in the KVM memory management path. KVM treats VM_IO|VM_PFNMAP regions as if they followed standard refcounted page semantics. The kernel does not refcount pages behind these VMAs, so freeing them while they remain mapped into a guest creates dangling host mappings. The absence of a strict read-only enforcement check compounds the issue by permitting writes through these mappings.

Attack Vector

Exploitation requires local access and the ability to create and control a KVM-backed virtual machine, such as via libvirt or QEMU. An attacker arranges a guest memory mapping backed by a VM_PFNMAP VMA, then triggers conditions under which the underlying host pages are freed. The guest retains a working mapping to these now-freed pages and can read or write their contents from inside the VM. By guiding the kernel allocator to reuse those pages for sensitive structures, such as page tables or credentials, the attacker escalates privileges on the host. The attack complexity is high because it requires precise timing and memory layout manipulation, but no user interaction is required.

No public exploit code or verified proof-of-concept is referenced in the available CVE data. The mechanism is described in the GitHub Security Advisory GHSA-7wq5-phmq-m584 and the Openwall OSS Security disclosure.

Detection Methods for CVE-2021-22543

Indicators of Compromise

Unexpected kernel oops or general protection faults in the KVM subsystem logged in dmesg or /var/log/messages.
Unprivileged users or service accounts spawning qemu-system-* or kvm processes with unusual memory-mapping behavior.
Anomalous host-side memory corruption symptoms following guest VM operations, including segfaults in unrelated host processes.

Detection Strategies

Inventory hosts running vulnerable Linux kernel builds dated on or before 2021-05-18 and correlate against KVM workload telemetry.
Monitor for local users invoking ioctl calls against /dev/kvm from contexts that are not part of expected virtualization workloads.
Audit kernel module load events and kernel version banners across the fleet to surface unpatched hypervisor hosts.

Monitoring Recommendations

Enable auditd rules for access to /dev/kvm and for execution of virtualization tooling outside sanctioned management accounts.
Forward kernel ring buffer messages and KVM-related warnings to a centralized log platform for correlation.
Track NetApp HCI and SolidFire BMC firmware versions against vendor advisory NTAP-20210708-0002 to identify outstanding updates.

How to Mitigate CVE-2021-22543

Immediate Actions Required

Apply the patched Linux kernel packages from your distribution maintainer, prioritizing hypervisor hosts that run multi-tenant or untrusted guest workloads.
Restrict access to /dev/kvm to a narrowly scoped group of trusted virtualization service accounts using filesystem permissions and Linux capabilities.
Update NetApp HCI compute nodes, storage nodes, and Cloud Backup deployments per advisory NTAP-20210708-0002.

Patch Information

Fixes are available through distribution channels. Refer to the Debian LTS Announcement (October 2021) and the Debian LTS Announcement (December 2021) for Debian package updates. Fedora users should apply the kernel updates announced in the Fedora Package Announcement (4G5YBUVE) and the Fedora Package Announcement (ROQIXQB7). NetApp customers should follow NetApp Security Advisory NTAP-20210708-0002.

Workarounds

Disable or unload the kvm, kvm_intel, and kvm_amd kernel modules on hosts that do not require virtualization.
Enforce mandatory access control profiles such as SELinux or AppArmor to confine QEMU/KVM processes and limit reachable host resources.
Migrate sensitive guest workloads off unpatched hosts until kernel updates are applied and the systems are rebooted.