CVE-2021-47094: 
Linux Kernel vulnerability analysis and mitigation

In the Linux kernel, a vulnerability (CVE-2021-47094) was discovered in the KVM (Kernel-based Virtual Machine) x86/mmu component. The issue involves incorrect iterator advancement after restart due to yielding in the TDP MMU (Two-Dimensional Paging Memory Management Unit). This vulnerability was disclosed on March 4, 2024 (NVD).

The vulnerability occurs when advancing the iterator results in skipping the top-level SPTE (Shadow Page Table Entry) and all its children, which becomes fatal if any skipped SPTEs were not visited before yielding. This is particularly critical when zapping all SPTEs (when min_level == root_level), as restarting the iterator and invoking tdp_iter_next() becomes fatal if the current gfn has a valid SPTE (Kernel Commit).

The vulnerability can manifest in two ways: 1) If a valid SPTE is skipped by both kvm_tdp_mmu_zap_all() and kvm_tdp_mmu_put_root(), the shadow page will be leaked, triggering a kernel warning. 2) If kvm_tdp_mmu_zap_all() skips a gfn/SPTE but that SPTE is then zapped by kvm_tdp_mmu_put_root(), it triggers a use-after-free condition, leading to potential data corruption and additional kernel errors (Kernel Commit).

The vulnerability has been assigned a CVSS v3.1 Base Score of 7.1 HIGH (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) by CISA-ADP (NVD). The local attack vector requires low privileges and no user interaction.

The vulnerability has been resolved in the Linux kernel through a patch that modifies the iterator behavior after restart due to yielding. The fix includes adding checks for iter->yielded status and proper handling of iterator advancement (Kernel Commit).