CVE-2021-47277: 
Linux Kernel vulnerability analysis and mitigation

CVE-2021-47277 addresses a speculation-based vulnerability in the Linux kernel's KVM (Kernel Virtual Machine) component. The vulnerability was discovered in KVM's mechanism for accessing guest memory, which translates guest physical addresses (gpa) to host virtual addresses. The issue was identified and patched in 2021, with the fix being implemented to prevent potential Spectre-style attacks from out-of-range memslot accesses (Kernel Patch).

The vulnerability exists in the __gfn_to_hva_memslot function, which performs address translation using the formula: hva = slot->userspace_addr + (gfn - slot->base_gfn) * PAGE_SIZE. While __gfn_to_memslot checks if the guest physical frame number (gfn) falls within the boundaries of guest physical memory, a CPU can speculate past this check and continue execution using an illegal gfn. This speculation can result in calculating out-of-bounds host virtual addresses, potentially leading to data leakage through speculative execution (Kernel Patch).

If exploited, this vulnerability could allow a guest to use speculation to read from the VMM's ring 3 address space through a Spectre gadget consisting of two consecutive reads, where the second read is data-dependent on the first. While initially not clearly exploitable on x86 systems due to get_user() containing an LFENCE speculation barrier, architectures like ARM that use address masking methods were potentially susceptible to these data-dependent access gadgets (Kernel Patch).

The vulnerability requires a guest to access invalid physical addresses in a way that produces an invalid gfn. While not immediately exploitable on x86 systems due to existing mitigations, the vulnerability became more concerning due to planned changes in x86 uaccess.h to replace LFENCE with address masking. One specific attack vector involved visiting guest page tables on x86 systems (NVD).

The vulnerability was fixed by implementing array_index_nospec in the __gfn_to_hva_memslot function to mask out-of-bounds gfns, which blocks speculation of invalid host virtual addresses. While the fix doesn't cover kvm_read_guest_offset_cached, this limitation was deemed acceptable as it only affects a few bytes past the end of the cache and is unlikely to be useful for building chains of data-dependent accesses (Kernel Patch).