Amazon Linux AMI: CVE-2021-47110: Security patch for kernel ((Multiple Advisories))

Description

In the Linux kernel, the following vulnerability has been resolved:

x86/kvm: Disable kvmclock on all CPUs on shutdown

Currenly, we disable kvmclock from machine_shutdown() hook and this

only happens for boot CPU. We need to disable it for all CPUs to

guard against memory corruption e.g. on restore from hibernate.

Note, writing '0' to kvmclock MSR doesn't clear memory location, it

just prevents hypervisor from updating the location so for the short

while after write and while CPU is still alive, the clock remains usable

and correct so we don't need to switch to some other clocksource.