CVE-2021-37576: 
Linux Kernel vulnerability analysis and mitigation

CVE-2021-37576 affects the Linux kernel through version 5.13.5 on the PowerPC platform, specifically in the KVM (Kernel-based Virtual Machine) implementation. The vulnerability was discovered in July 2021 and exists in the arch/powerpc/kvm/book3s_rtas.c file, where improper validation of rtas_args.nargs allows KVM guest OS users to cause host OS memory corruption (NVD, Kernel Commit).

The vulnerability stems from a buffer overflow in the H_RTAS hypercall handling where args.rets is made to point into the args.args buffer located on the stack without proper range checking of args.nargs. This allows a guest to point args.rets anywhere up to +16GB from args.args. The value written is always (u32)-3, as subsequent code does check nargs. The bug was introduced in commit 8e591cb72047 and affects Linux kernel versions from 3.10 through 5.13.5 (Mailing List). The CVSS v3.1 base score is 7.8 (HIGH) with vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NetApp Advisory).

When successfully exploited, this vulnerability can lead to host OS memory corruption. The impact is somewhat limited as the guest does not have control over what is written to the corrupted memory location, and each guest only has a single attempt at exploitation before being terminated. Only systems using Linux as the hypervisor (KVM) or bare metal configurations on PowerPC platforms are affected (Mailing List).

The vulnerability requires local access with guest OS privileges in a KVM environment on PowerPC systems. While the exploit is limited in scope (single-shot attempt with fixed write value), it can be triggered by a malicious guest OS user. The guest will be terminated after the exploitation attempt, limiting the potential for repeated attacks (Kernel Commit).

The vulnerability was fixed in Linux kernel 5.14 with commit f62f3c20647e (KVM: PPC: Book3S: Fix H_RTAS rets buffer overflow). Various distributions have backported the fix to their supported kernel versions. Red Hat has addressed it in RHEL 7.3 Advanced Update Support (Red Hat Advisory), Debian has fixed it in version 5.10.46-5 (Debian Advisory), and Fedora has included fixes in kernel versions 5.13.6-100.fc33 and 5.13.6-200.fc34 (Fedora Updates).