{
  "cveId": "CVE-2021-47094",
  "url": "https://patchblox.com/security/cve/CVE-2021-47094",
  "summary": "CVE-2021-47094 is fixed in linux on 1 platform, first by DEBIAN-CVE-2021-47094, released March 4, 2024. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  KVM: x86/mmu: Don\u0027t advance iterator after resta...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  KVM: x86/mmu: Don\u0027t advance iterator after restart due to yielding  After dropping mmu_lock in the TDP MMU, restart the iterator during tdp_iter_next() and do not advance the iterator.  Advancing the iterator results in skipping the top-level SPTE and all its children, which is fatal if any of the skipped SPTEs were not visited before yielding.  When zapping all SPTEs, i.e. when min_level == root_level, restarting the iter and then invoking tdp_iter_next() is always fatal if the current gfn has as a valid SPTE, as advancing the iterator results in try_step_side() skipping the current gfn, which wasn\u0027t visited before yielding.  Sprinkle WARNs on iter-\u003Eyielded being true in various helpers that are often used in conjunction with yielding, and tag the helper with __must_check to reduce the probabily of improper usage.  Failing to zap a top-level SPTE manifests in one of two ways.  If a valid SPTE is skipped by both kvm_tdp_mmu_zap_all() and kvm_tdp_mmu_put_root(), the shadow page will be leaked and KVM will WARN accordingly.    WARNING: CPU: 1 PID: 3509 at arch/x86/kvm/mmu/tdp_mmu.c:46 [kvm]   RIP: 0010:kvm_mmu_uninit_tdp_mmu\u002B0x3e/0x50 [kvm]   Call Trace:    \u003CTASK\u003E    kvm_arch_destroy_vm\u002B0x130/0x1b0 [kvm]    kvm_destroy_vm\u002B0x162/0x2a0 [kvm]    kvm_vcpu_release\u002B0x34/0x60 [kvm]    __fput\u002B0x82/0x240    task_work_run\u002B0x5c/0x90    do_exit\u002B0x364/0xa10    ? futex_unqueue\u002B0x38/0x60    do_group_exit\u002B0x33/0xa0    get_signal\u002B0x155/0x850    arch_do_signal_or_restart\u002B0xed/0x750    exit_to_user_mode_prepare\u002B0xc5/0x120    syscall_exit_to_user_mode\u002B0x1d/0x40    do_syscall_64\u002B0x48/0xc0    entry_SYSCALL_64_after_hwframe\u002B0x44/0xae  If kvm_tdp_mmu_zap_all() skips a gfn/SPTE but that SPTE is then zapped by kvm_tdp_mmu_put_root(), KVM triggers a use-after-free in the form of marking a struct page as dirty/accessed after it has been put back on the free list.  This directly triggers a WARN due to encountering a page with page_count() == 0, but it can also lead to data corruption and additional errors in the kernel.    WARNING: CPU: 7 PID: 1995658 at arch/x86/kvm/../../../virt/kvm/kvm_main.c:171   RIP: 0010:kvm_is_zone_device_pfn.part.0\u002B0x9e/0xd0 [kvm]   Call Trace:    \u003CTASK\u003E    kvm_set_pfn_dirty\u002B0x120/0x1d0 [kvm]    __handle_changed_spte\u002B0x92e/0xca0 [kvm]    __handle_changed_spte\u002B0x63c/0xca0 [kvm]    __handle_changed_spte\u002B0x63c/0xca0 [kvm]    __handle_changed_spte\u002B0x63c/0xca0 [kvm]    zap_gfn_range\u002B0x549/0x620 [kvm]    kvm_tdp_mmu_put_root\u002B0x1b6/0x270 [kvm]    mmu_free_root_page\u002B0x219/0x2c0 [kvm]    kvm_mmu_free_roots\u002B0x1b4/0x4e0 [kvm]    kvm_mmu_unload\u002B0x1c/0xa0 [kvm]    kvm_arch_destroy_vm\u002B0x1f2/0x5c0 [kvm]    kvm_put_kvm\u002B0x3b1/0x8b0 [kvm]    kvm_vcpu_release\u002B0x4e/0x70 [kvm]    __fput\u002B0x1f7/0x8c0    task_work_run\u002B0xf8/0x1a0    do_exit\u002B0x97b/0x2230    do_group_exit\u002B0xda/0x2a0    get_signal\u002B0x3be/0x1e50    arch_do_signal_or_restart\u002B0x244/0x17f0    exit_to_user_mode_prepare\u002B0xcb/0x120    syscall_exit_to_user_mode\u002B0x1d/0x40    do_syscall_64\u002B0x4d/0x90    entry_SYSCALL_64_after_hwframe\u002B0x44/0xae  Note, the underlying bug existed even before commit 1af4a96025b3 (\u0022KVM: x86/mmu: Yield in TDU MMU iter even if no SPTES changed\u0022) moved calls to tdp_mmu_iter_cond_resched() to the beginning of loops, as KVM could still incorrectly advance past a top-level entry when yielding on a lower-level entry.  But with respect to leaking shadow pages, the bug was introduced by yielding before processing the current gfn.  Alternatively, tdp_mmu_iter_cond_resched() could simply fall through, or callers could jump to their \u0022retry\u0022 label.  The downside of that approach is that tdp_mmu_iter_cond_resched() _must_ be called before anything else in the loop, and there\u0027s no easy way to enfornce that requirement.  Ideally, KVM would handling the cond_resched() fully within the iterator macro (the code is actually quite clean) and avoid this entire class of bugs, but that is extremely difficult do wh ---truncated---",
  "published": "2024-03-04T18:15:07Z",
  "severity": "high",
  "cvss": 7.8,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00218,
  "epssPercentile": 0.12389,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "5.15.15-1",
      "fix": "DEBIAN-CVE-2021-47094",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2021-47094",
      "released": "2024-03-04T18:15:07Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "5.15.15-1",
      "fix": "DEBIAN-CVE-2021-47094",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2021-47094",
      "released": "2024-03-04T18:15:07Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "5.15.15-1",
      "fix": "DEBIAN-CVE-2021-47094",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2021-47094",
      "released": "2024-03-04T18:15:07Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T07:25:28Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}