PT-2024-11087 · Linux · Linux Kernel

Published 2021-05-07 · Updated 2024-11-04 · CVE-2021-46978

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue arises when enlightened VMCS is in use and nested state is migrated with vmx get nested state()/vmx set nested state(). KVM cannot map the eVMCS page right away because the eVMCS GPA is not 'struct kvm vmx nested state hdr' and it cannot be read from the VP assist page. To address this, /vmx set nested state() raises a KVM REQ GET NESTED STATE PAGES request. However, the fix is not ideal as it is challenging to propagate possible failures, and even if it were possible, it might be too late. The idea of using KVM REQ GET NESTED STATE PAGES for mapping eVMCS after migration seems fragile due to the divergence from the native path when vmptr loading occurs on vmx set nested state().

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2025-02853

CVE-2021-46978

Affected Products

Linux Kernel

References · 24

• https://git.kernel.org/stable/c/200a45649ab7361bc80c70aebf7165b64f9a6c9f · Patch
• https://ubuntu.com/security/CVE-2021-46978 · Vendor Advisory
• https://git.kernel.org/stable/c/bd0e8455b85b651a4c77de9616e307129b15aaa7 · Patch
• https://git.kernel.org/stable/c/c8bf64e3fb77cc19bad146fbe26651985b117194 · Patch
• https://git.kernel.org/stable/c/f5c7e8425f18fdb9bdb7d13340651d7876890329 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-46978 · Security Note
• https://bdu.fstec.ru/vul/2025-02853 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-46978 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-46978 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-46978 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-46978 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-46978 · Vendor Advisory
• https://lore.kernel.org/linux-cve-announce/2024022822-CVE-2021-46978-3516@gregkh · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-46978 · Note
• https://lore.kernel.org/linux-cve-announce/2024022822-CVE-2021-46978-3516@gregkh/T/#u · Note