CVE-2021-46927 in Linux
Summary
by MITRE • 02/27/2024
In the Linux kernel, the following vulnerability has been resolved:
nitro_enclaves: Use get_user_pages_unlocked() call to handle mmap assert
After commit 5b78ed24e8ec ("mm/pagemap: add mmap_assert_locked() annotations to find_vma*()"), the call to get_user_pages() will trigger the mmap assert.
static inline void mmap_assert_locked(struct mm_struct *mm) {
lockdep_assert_held(&mm->mmap_lock); VM_BUG_ON_MM(!rwsem_is_locked(&mm->mmap_lock), mm); }
[ 62.521410] kernel BUG at include/linux/mmap_lock.h:156!
........................................................... [ 62.538938] RIP: 0010:find_vma+0x32/0x80
........................................................... [ 62.605889] Call Trace:
[ 62.608502]
[ 62.610956] ? lock_timer_base+0x61/0x80
[ 62.614106] find_extend_vma+0x19/0x80
[ 62.617195] __get_user_pages+0x9b/0x6a0
[ 62.620356] __gup_longterm_locked+0x42d/0x450
[ 62.623721] ? finish_wait+0x41/0x80
[ 62.626748] ? __kmalloc+0x178/0x2f0
[ 62.629768] ne_set_user_memory_region_ioctl.isra.0+0x225/0x6a0 [nitro_enclaves]
[ 62.635776] ne_enclave_ioctl+0x1cf/0x6d7 [nitro_enclaves]
[ 62.639541] __x64_sys_ioctl+0x82/0xb0
[ 62.642620] do_syscall_64+0x3b/0x90
[ 62.645642] entry_SYSCALL_64_after_hwframe+0x44/0xae
Use get_user_pages_unlocked() when setting the enclave memory regions. That's a similar pattern as mmap_read_lock() used together with get_user_pages().
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/18/2025
The vulnerability CVE-2021-46927 affects the Linux kernel's nitro_enclaves subsystem and represents a critical issue in memory management operations that can lead to kernel crashes and potential denial of service conditions. This flaw emerged following a specific kernel commit that introduced mmap_assert_locked() annotations to the find_vma*() functions, which subsequently caused get_user_pages() calls to trigger assertion failures. The root cause lies in the improper handling of memory mapping locks during enclave memory region setup operations, creating a scenario where kernel BUG conditions are triggered when the mmap_lock is not properly acquired before memory page operations.
The technical implementation of this vulnerability manifests when the nitro_enclaves driver attempts to set user memory regions through ioctl operations, specifically in the ne_set_user_memory_region_ioctl function. The call stack shows that the execution path leads from the ioctl handler through find_extend_vma, __get_user_pages, and ultimately to the kernel BUG condition in find_vma function. The mmap_assert_locked macro enforces that the mmap_lock must be held when accessing virtual memory areas, but the current implementation fails to properly acquire this lock before calling get_user_pages() functions. This violates the locking protocol established by the kernel's memory management subsystem and creates a direct conflict with the lockdep subsystem that enforces lock ordering requirements.
This vulnerability directly impacts the Linux kernel's memory management integrity and can be classified under CWE-691, which deals with insufficient control flow management. The operational impact extends beyond simple crashes to potentially compromise system stability and availability, particularly in environments utilizing AWS Nitro Enclaves technology where secure memory isolation is paramount. The flaw represents a failure in the kernel's memory management locking protocol and can be mapped to ATT&CK technique T1499.004, which involves network disruption through denial of service attacks, as system crashes can render the entire kernel or specific subsystems unavailable. The vulnerability affects systems running kernel versions where the problematic commit 5b78ed24e8ec was introduced, making it particularly concerning for cloud environments that rely on secure enclaves for confidential computing workloads.
The recommended mitigation strategy involves implementing the get_user_pages_unlocked() function call pattern that properly handles the mmap_lock requirements, similar to how mmap_read_lock() is used in conjunction with get_user_pages() operations. This approach ensures that the proper locking semantics are maintained throughout the memory management operations, preventing the assertion failures that trigger the kernel BUG conditions. System administrators should update to kernel versions that include the fix, which typically involves modifying the nitro_enclaves driver to use the unlocked version of get_user_pages() functions, thereby avoiding the problematic lock assertion checks while maintaining the necessary memory management functionality. The fix pattern follows established kernel development practices for handling memory management operations under proper locking contexts and aligns with the Linux kernel's documented approaches for safe user memory access operations.