{
  "threat_severity" : "Important",
  "public_date" : "2021-07-23T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: powerpc: KVM guest OS users can cause host OS memory corruption",
    "id" : "1986506",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=1986506"
  },
  "cvss3" : {
    "cvss3_base_score" : "7.8",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-1284",
  "details" : [ "arch/powerpc/kvm/book3s_rtas.c in the Linux kernel through 5.13.5 on the powerpc platform allows KVM guest OS users to cause host OS memory corruption via rtas_args.nargs, aka CID-f62f3c20647e.", "A flaw was found on the Linux kernel. On the PowerPC platform, the KVM guest allows the OS users to cause host OS memory corruption via rtas_args.nargs. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability." ],
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 7",
    "release_date" : "2021-10-12T00:00:00Z",
    "advisory" : "RHSA-2021:3768",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7",
    "package" : "kpatch-patch"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "release_date" : "2021-10-12T00:00:00Z",
    "advisory" : "RHSA-2021:3801",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7",
    "package" : "kernel-0:3.10.0-1160.45.1.el7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7.3 Advanced Update Support",
    "release_date" : "2021-10-12T00:00:00Z",
    "advisory" : "RHSA-2021:3766",
    "cpe" : "cpe:/o:redhat:rhel_aus:7.3",
    "package" : "kernel-0:3.10.0-514.93.1.el7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7.4 Advanced Update Support",
    "release_date" : "2021-10-05T00:00:00Z",
    "advisory" : "RHSA-2021:3725",
    "cpe" : "cpe:/o:redhat:rhel_aus:7.4",
    "package" : "kernel-0:3.10.0-693.94.1.el7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7.6 Advanced Update Support(Disable again in 2026 - SPRHEL-7118)",
    "release_date" : "2021-10-12T00:00:00Z",
    "advisory" : "RHSA-2021:3812",
    "cpe" : "cpe:/o:redhat:rhel_aus:7.6",
    "package" : "kernel-0:3.10.0-957.84.1.el7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7.6 Telco Extended Update Support",
    "release_date" : "2021-10-12T00:00:00Z",
    "advisory" : "RHSA-2021:3812",
    "cpe" : "cpe:/o:redhat:rhel_tus:7.6",
    "package" : "kernel-0:3.10.0-957.84.1.el7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7.6 Update Services for SAP Solutions",
    "release_date" : "2021-10-12T00:00:00Z",
    "advisory" : "RHSA-2021:3812",
    "cpe" : "cpe:/o:redhat:rhel_e4s:7.6",
    "package" : "kernel-0:3.10.0-957.84.1.el7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7.6 Update Services for SAP Solutions",
    "release_date" : "2021-10-12T00:00:00Z",
    "advisory" : "RHSA-2021:3814",
    "cpe" : "cpe:/o:redhat:rhel_e4s:7.6",
    "package" : "kpatch-patch"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7.7 Advanced Update Support",
    "release_date" : "2021-10-26T00:00:00Z",
    "advisory" : "RHSA-2021:3987",
    "cpe" : "cpe:/o:redhat:rhel_aus:7.7",
    "package" : "kernel-0:3.10.0-1062.59.1.el7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7.7 Telco Extended Update Support",
    "release_date" : "2021-10-26T00:00:00Z",
    "advisory" : "RHSA-2021:3987",
    "cpe" : "cpe:/o:redhat:rhel_tus:7.7",
    "package" : "kernel-0:3.10.0-1062.59.1.el7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7.7 Update Services for SAP Solutions",
    "release_date" : "2021-10-26T00:00:00Z",
    "advisory" : "RHSA-2021:3987",
    "cpe" : "cpe:/o:redhat:rhel_e4s:7.7",
    "package" : "kernel-0:3.10.0-1062.59.1.el7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7.7 Update Services for SAP Solutions",
    "release_date" : "2021-10-26T00:00:00Z",
    "advisory" : "RHSA-2021:4000",
    "cpe" : "cpe:/o:redhat:rhel_e4s:7.7",
    "package" : "kpatch-patch"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2021-09-07T00:00:00Z",
    "advisory" : "RHSA-2021:3436",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8",
    "package" : "kpatch-patch"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2021-09-07T00:00:00Z",
    "advisory" : "RHSA-2021:3447",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8",
    "package" : "kernel-0:4.18.0-305.17.1.el8_4"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.1 Extended Update Support",
    "release_date" : "2021-09-07T00:00:00Z",
    "advisory" : "RHSA-2021:3442",
    "cpe" : "cpe:/o:redhat:rhel_eus:8.1",
    "package" : "kpatch-patch"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.1 Extended Update Support",
    "release_date" : "2021-09-07T00:00:00Z",
    "advisory" : "RHSA-2021:3444",
    "cpe" : "cpe:/o:redhat:rhel_eus:8.1",
    "package" : "kernel-0:4.18.0-147.54.2.el8_1"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.2 Extended Update Support",
    "release_date" : "2021-09-07T00:00:00Z",
    "advisory" : "RHSA-2021:3443",
    "cpe" : "cpe:/o:redhat:rhel_eus:8.2",
    "package" : "kpatch-patch"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.2 Extended Update Support",
    "release_date" : "2021-09-07T00:00:00Z",
    "advisory" : "RHSA-2021:3446",
    "cpe" : "cpe:/o:redhat:rhel_eus:8.2",
    "package" : "kernel-0:4.18.0-193.65.2.el8_2"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Will not fix",
    "package_name" : "kernel-alt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2021-37576\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-37576\nhttps://www.openwall.com/lists/oss-security/2021/07/26/1" ],
  "name" : "CVE-2021-37576",
  "mitigation" : {
    "value" : "Mitigation for this issue is either not available or the currently available options does not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
    "lang" : "en:us"
  },
  "csaw" : false
}