CVE-2021-46978— KVM: nVMX: Always make an attempt to map eVMCS after migration
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2021-46978
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
KVM: nVMX: Always make an attempt to map eVMCS after migration
Source: NVD (National Vulnerability Database)
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Always make an attempt to map eVMCS after migration When enlightened VMCS is in use and nested state is migrated with vmx_get_nested_state()/vmx_set_nested_state() KVM can't map evmcs page right away: evmcs gpa is not 'struct kvm_vmx_nested_state_hdr' and we can't read it from VP assist page because userspace may decide to restore HV_X64_MSR_VP_ASSIST_PAGE after restoring nested state (and QEMU, for example, does exactly that). To make sure eVMCS is mapped /vmx_set_nested_state() raises KVM_REQ_GET_NESTED_STATE_PAGES request. Commit f2c7ef3ba955 ("KVM: nSVM: cancel KVM_REQ_GET_NESTED_STATE_PAGES on nested vmexit") added KVM_REQ_GET_NESTED_STATE_PAGES clearing to nested_vmx_vmexit() to make sure MSR permission bitmap is not switched when an immediate exit from L2 to L1 happens right after migration (caused by a pending event, for example). Unfortunately, in the exact same situation we still need to have eVMCS mapped so nested_sync_vmcs12_to_shadow() reflects changes in VMCS12 to eVMCS. As a band-aid, restore nested_get_evmcs_page() when clearing KVM_REQ_GET_NESTED_STATE_PAGES in nested_vmx_vmexit(). The 'fix' is far from being ideal as we can't easily propagate possible failures and even if we could, this is most likely already too late to do so. The whole 'KVM_REQ_GET_NESTED_STATE_PAGES' idea for mapping eVMCS after migration seems to be fragile as we diverge too much from the 'native' path when vmptr loading happens on vmx_set_nested_state().
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel 存在安全漏洞。目前尚无此漏洞的相关信息，请随时关注CNNVD或厂商公告。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2021-46978
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-46978
请登录查看更多情报信息。
Same Patch Batch · Linux · 2024-02-28 · 86 CVEs total
| CVE-2021-46997 | arm64: entry: always set GIC_PRIO_PSR_I_SET during entry | |
| CVE-2021-47001 | xprtrdma: Fix cwnd update ordering | |
| CVE-2021-46998 | ethernet:enic: Fix a use after free bug in enic_hard_start_xmit | |
| CVE-2021-47000 | ceph: fix inode leak on getattr error in __fh_to_dentry | |
| CVE-2021-47003 | dmaengine: idxd: Fix potential null dereference on pointer status | |
| CVE-2021-47005 | PCI: endpoint: Fix NULL pointer dereference for ->get_features() | |
| CVE-2021-47007 | f2fs: fix panic during f2fs_resize_fs() | |
| CVE-2021-47006 | ARM: 9064/1: hw_breakpoint: Do not directly check the event's overflow_handler hook | |
| CVE-2021-47009 | KEYS: trusted: Fix memory leak on object td | |
| CVE-2021-47004 | f2fs: fix to avoid touching checkpointed data in get_victim() | |
| CVE-2021-46999 | sctp: do asoc update earlier in sctp_sf_do_dupcook_a | |
| CVE-2021-46995 | can: mcp251xfd: mcp251xfd_probe(): fix an error pointer dereference in probe | |
| CVE-2021-46996 | netfilter: nftables: Fix a memleak from userdata error path in new objects | |
| CVE-2021-46994 | can: mcp251x: fix resume from sleep before interface was brought up | |
| CVE-2021-46992 | netfilter: nftables: avoid overflows in nft_hash_buckets() | |
| CVE-2021-46993 | sched: Fix out-of-bound access in uclamp | |
| CVE-2021-46990 | powerpc/64s: Fix crashes when toggling entry flush barrier | |
| CVE-2021-46991 | i40e: Fix use-after-free in i40e_client_subtask() | |
| CVE-2021-46989 | hfsplus: prevent corruption in shrinking truncate | |
| CVE-2021-46987 | btrfs: fix deadlock when cloning inline extents and using qgroups |
Showing top 20 of 86 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
- CVE-2026-43500
rxrpc: Also unshare DATA/RESPONSE packets when paged frags a - CVE-2026-43475
scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT - CVE-2026-43474
fs: init flags_valid before calling vfs_fileattr_get - CVE-2026-43473
scsi: mpi3mr: Add NULL checks when resetting request and rep - CVE-2026-43472
unshare: fix unshare_fs() handling
Same vendor: Linux
- CVE-2026-43500
rxrpc: Also unshare DATA/RESPONSE packets when paged frags a - CVE-2026-43475
scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT - CVE-2026-43474
fs: init flags_valid before calling vfs_fileattr_get - CVE-2026-43473
scsi: mpi3mr: Add NULL checks when resetting request and rep - CVE-2026-43472
unshare: fix unshare_fs() handling
V. Comments for CVE-2021-46978
No comments yet