CVE-2021-47230

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86: Immediately reset the MMU context when the SMM flag is cleared

Immediately reset the MMU context when the vCPU's SMM flag is cleared so

that the SMM flag in the MMU role is always synchronized with the vCPU's

flag. If RSM fails (which isn't correctly emulated), KVM will bail

without calling post_leave_smm() and leave the MMU in a bad state.

The bad MMU role can lead to a NULL pointer dereference when grabbing a

shadow page's rmap for a page fault as the initial lookups for the gfn

will happen with the vCPU's SMM flag (=0), whereas the rmap lookup will

use the shadow page's SMM flag, which comes from the MMU (=1). SMM has

an entirely different set of memslots, and so the initial lookup can find

a memslot (SMM=0) and then explode on the rmap memslot lookup (SMM=1).

general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN

KASAN: null-ptr-deref in rang

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References