CVE-2021-46978

What it actually does

Failure to map the enlightened VMCS page after nested state migration in KVM nVMX causes nested_sync_vmcs12_to_shadow to operate on stale or unmapped state when an immediate L2-to-L1 exit occurs.

Why it matters to the business

Nested virtualization workloads on KVM hosts may experience state inconsistency after live migration, increasing risk of guest-to-host escapes or denial of service in cloud and container platforms that rely on nested VMs.

How an attack unfolds

An attacker controlling a nested guest triggers migration of nested state via vmx_set_nested_state, arranges for a pending event to force an immediate nested vmexit, and leverages the resulting eVMCS desynchronization to corrupt MSR permission bitmaps or VMCS12 fields for privilege escalation.

How to fix it

Update the Linux kernel to a version containing commit f2c7ef3ba955 and the follow-on restoration of nested_get_evmcs_page in nested_vmx_vmexit; rebuild and reboot affected hosts; verify nested migration paths in test environments before production rollout.

How to confirm the fix worked

Confirm kernel version contains the referenced commits; run synthetic nested migration tests that force immediate exits after vmx_set_nested_state and verify eVMCS mapping succeeds without state corruption.

Typical attack path

1. Establish nested VMX environment with enlightened VMCS enabled
2. Perform live migration of nested state
3. Induce immediate L2-to-L1 exit via pending event before eVMCS mapping completes
4. Exploit resulting VMCS12/eVMCS desync to modify control structures

How to detect it

Review kernel logs for KVM nested state warnings around migration events; inspect audit trails for unexpected nested_vmx_vmexit sequences immediately following vmx_set_nested_state calls; correlate with hypervisor-level migration records.

What your security team should do

• Prioritize kernel updates on all KVM hosts supporting nested virtualization within the next maintenance window
• Disable nested virtualization where not required until patches are applied
• Monitor for unusual nested VM exit patterns or MSR bitmap modifications in logs