CVE-2021-47639

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86/mmu: Zap _all_ roots when unmapping gfn range in TDP MMU

Zap both valid and invalid roots when zapping/unmapping a gfn range, as

KVM must ensure it holds no references to the freed page after returning

from the unmap operation. Most notably, the TDP MMU doesn't zap invalid

roots in mmu_notifier callbacks. This leads to use-after-free and other

issues if the mmu_notifier runs to completion while an invalid root

zapper yields as KVM fails to honor the requirement that there must be

_no_ references to the page after the mmu_notifier returns.

The bug is most easily reproduced by hacking KVM to cause a collision

between set_nx_huge_pages() and kvm_mmu_notifier_release(), but the bug

exists between kvm_mmu_notifier_invalidate_range_start() and memslot

updates as well. Invalidating a root ensures pages aren't accessible by

the guest, and KVM won't read or write page data itself, but KVM will

trigger e.g. kvm_se

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References