CVE-2021-46927: 
Linux Kernel vulnerability analysis and mitigation

CVE-2021-46927 affects the Linux kernel's nitro_enclaves module. The vulnerability was discovered when a mmap assert was triggered after commit 5b78ed24e8ec ("mm/pagemap: add mmap_assert_locked() annotations to find_vma*()"), causing improper locking behavior. The issue affects Linux kernel versions from 5.15.0 up to (excluding) 5.15.13 (NVD).

The vulnerability occurs in the nitro_enclaves module when calling get_user_pages() without proper locking mechanisms. The issue manifests as a kernel BUG at include/linux/mmap_lock.h:156, triggered by the mmap assert in the find_vma function. The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 (MEDIUM) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability can lead to a kernel panic due to improper locking, potentially causing system availability issues. The CVSS score indicates that while confidentiality and integrity are not affected, there is a high impact on system availability (NVD).

The vulnerability has been patched by replacing get_user_pages() with get_user_pages_unlocked() when setting the enclave memory regions. This fix follows a similar pattern as mmap_read_lock() used together with get_user_pages(). The patch is available in the kernel source tree (Kernel Patch).