CVE-2021-47092

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

KVM: VMX: Always clear vmx->fail on emulation_required

Revert a relatively recent change that set vmx->fail if the vCPU is in L2

and emulation_required is true, as that behavior is completely bogus.

Setting vmx->fail and synthesizing a VM-Exit is contradictory and wrong:

(a) it's impossible to have both a VM-Fail and VM-Exit

(b) vmcs.EXIT_REASON is not modified on VM-Fail

(c) emulation_required refers to guest state and guest state checks are

always VM-Exits, not VM-Fails.

For KVM specifically, emulation_required is handled before nested exits

in __vmx_handle_exit(), thus setting vmx->fail has no immediate effect,

i.e. KVM calls into handle_invalid_guest_state() and vmx->fail is ignored.

Setting vmx->fail can ultimately result in a WARN in nested_vmx_vmexit()

firing when tearing down the VM as KVM never expects vmx->fail to be set

when L2 is active, KVM always reflects those errors into L1.

---------

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References