CVE-2021-47390 is a vulnerability identified in the Linux kernel's KVM (Kernel-based Virtual Machine) module, specifically affecting the x86 architecture. The issue arises from a stack-out-of-bounds memory access in the function ioapic_write_indirect(), as detected by Kernel Address Sanitizer (KASAN). The root cause is improper allocation of the 'vcpu_bitmap' variable on the stack. Instead of allocating enough space for all possible virtual CPUs (vCPUs) defined by KVM_MAX_VCPUS, it is allocated as a single long integer. This leads to out-of-bounds memory access when the code attempts to manipulate the bitmap representing vCPUs. Additionally, the code erroneously clears the lower 16 bits of this bitmap, likely due to confusion between similarly named variables with different sizes. The vulnerability manifests during operations involving virtual CPU requests and IOAPIC (I/O Advanced Programmable Interrupt Controller) write operations within the KVM module. Exploitation could potentially cause kernel crashes or undefined behavior due to memory corruption. However, there are no known exploits in the wild at this time, and no CVSS score has been assigned. The vulnerability affects Linux kernel versions identified by the commit hash 7ee30bc132c683d06a6d9e360e39e483e3990708 and likely other versions containing the same flawed code. The issue has been publicly disclosed and patched by the Linux kernel maintainers.

For European organizations, this vulnerability poses a risk primarily to environments running Linux-based virtualization infrastructure using KVM on x86 hardware. Organizations relying on virtualized workloads, cloud services, or private data centers with KVM virtualization could experience denial of service (DoS) conditions if the vulnerability is triggered, as the stack-out-of-bounds access may cause kernel panics or crashes. While direct remote exploitation is unlikely without additional vulnerabilities, a malicious or compromised guest VM or local user with access to the KVM subsystem could potentially trigger the flaw, leading to host instability or potential privilege escalation if combined with other bugs. This could disrupt critical services, affecting availability and operational continuity. Confidentiality and integrity impacts are less certain but cannot be ruled out if the memory corruption leads to arbitrary code execution. Given the widespread use of Linux and KVM in European public and private sectors, including government, finance, and telecommunications, the vulnerability warrants prompt attention to avoid service disruptions and maintain trust in virtualized infrastructure.

European organizations should prioritize updating their Linux kernel to the latest patched versions that address CVE-2021-47390. Specifically, kernel versions incorporating the fix for the KVM ioapic_write_indirect() stack-out-of-bounds issue should be deployed. For environments where immediate patching is not feasible, administrators should restrict access to KVM management interfaces and limit the ability of untrusted users or guest VMs to invoke IOAPIC write operations or other KVM functions that could trigger the vulnerability. Employing strict access controls, SELinux/AppArmor policies, and isolating critical virtual machines can reduce risk. Monitoring kernel logs for KASAN reports or unusual KVM behavior can help detect attempts to exploit the flaw. Additionally, organizations should review their virtualization security posture, ensuring that hypervisor and guest isolation mechanisms are robust. Regular vulnerability scanning and patch management processes should be enforced to prevent exploitation of this and similar vulnerabilities.