CVE-2021-47094

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86/mmu: Don't advance iterator after restart due to yielding

After dropping mmu_lock in the TDP MMU, restart the iterator during

tdp_iter_next() and do not advance the iterator. Advancing the iterator

results in skipping the top-level SPTE and all its children, which is

fatal if any of the skipped SPTEs were not visited before yielding.

When zapping all SPTEs, i.e. when min_level == root_level, restarting the

iter and then invoking tdp_iter_next() is always fatal if the current gfn

has as a valid SPTE, as advancing the iterator results in try_step_side()

skipping the current gfn, which wasn't visited before yielding.

Sprinkle WARNs on iter->yielded being true in various helpers that are

often used in conjunction with yielding, and tag the helper with

__must_check to reduce the probabily of improper usage.

Failing to zap a top-level SPTE manifests in one of two ways. If a valid

SPTE is skipped by both kvm_t

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References