CVE-2021-46978: 
Linux Kernel vulnerability analysis and mitigation

In the Linux kernel, a vulnerability has been identified in the KVM (Kernel Virtual Machine) nested virtualization functionality, specifically related to the handling of enlightened VMCS (Virtual Machine Control Structure) after migration. The issue was discovered and fixed in 2021, tracked as CVE-2021-46978. When enlightened VMCS is in use and nested state is migrated using vmx_get_nested_state()/vmx_set_nested_state(), KVM cannot map the evmcs page immediately due to certain timing and state management issues (Kernel Commit).

The vulnerability occurs because the evmcs gpa is not part of the 'struct kvm_vmx_nested_state_hdr' and cannot be read from the VP assist page, as userspace may decide to restore HV_X64_MSR_VP_ASSIST_PAGE after restoring nested state. The issue was complicated by a previous fix (commit f2c7ef3ba955) which added KVM_REQ_GET_NESTED_STATE_PAGES clearing to nested_vmx_vmexit() to prevent MSR permission bitmap switching during L2 to L1 transitions after migration. However, this created a situation where eVMCS mapping was still needed for nested_sync_vmcs12_to_shadow() to properly reflect VMCS12 changes to eVMCS (Kernel Commit).

The vulnerability affects systems using KVM virtualization with nested virtualization enabled, particularly in scenarios involving VM migration. The issue could potentially lead to improper state management and synchronization problems between the host and guest virtual machines (Kernel Commit).

The vulnerability has been assigned a CVSS v3.1 Base Score of 7.8 (HIGH) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H by CISA-ADP (NVD).

The issue has been fixed by modifying the nested_vmx_vmexit() function to always attempt mapping eVMCS when clearing KVM_REQ_GET_NESTED_STATE_PAGES. The fix ensures proper state synchronization during VM migration and L2 to L1 transitions. The patch has been implemented in the Linux kernel and is available through standard kernel updates (Kernel Commit).