CVE-2021-47262 is a vulnerability identified in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem, specifically related to the x86 architecture nested virtualization feature. The issue arises from improper handling of string literals used in tracepoints for nested VM-Enter failure messages. Tracepoints are debugging hooks in the kernel that log events; in this case, the tracepoint logs failures when entering a nested virtual machine. The vulnerability stems from the fact that the tracepoint uses string literals defined in vendor-specific modules (kvm-intel and kvm-amd). When these modules are built as loadable kernel modules and subsequently unloaded, the memory holding these string literals is freed. However, the tracepoint and its ring buffer data persist until the main kvm module is unloaded or indefinitely if kvm is built into the kernel. This leads to a use-after-free condition where the tracepoint attempts to access stale memory, potentially causing kernel crashes or undefined behavior. The fix involves using the __string() mechanism provided by the Linux kernel's tracing subsystem, which makes a safe copy of the string literals to ensure their lifetime matches the tracepoint's usage. This vulnerability has existed since the tracepoint was introduced but was recently exposed due to enhanced checks in the tracing subsystem. The CVSS 3.1 score of 7.1 (High) reflects that exploitation requires local access with low complexity and privileges but can lead to high confidentiality impact and availability disruption. No known exploits are reported in the wild. The vulnerability affects Linux kernel versions containing the vulnerable tracepoint implementation, particularly those with KVM nested virtualization enabled and using kvm-intel or kvm-amd modules as loadable components.

For European organizations, the impact of CVE-2021-47262 can be significant, especially for those relying on Linux-based virtualization infrastructure using KVM with nested virtualization enabled. The vulnerability could lead to kernel crashes or denial of service on hosts running nested VMs, potentially disrupting critical services and workloads. Confidentiality impact is high because kernel memory corruption could be leveraged to leak sensitive information, although exploitation complexity and required privileges limit this risk to local users or processes with some level of access. Organizations using cloud environments, private data centers, or development/testing platforms with nested virtualization are particularly at risk. Service availability could be affected, leading to downtime and operational disruptions. While no remote exploitation is indicated, insider threats or compromised local accounts could exploit this vulnerability. The issue also poses risks to system stability and reliability, which are critical for sectors such as finance, healthcare, and government services prevalent in Europe.

European organizations should prioritize patching Linux kernels to versions where this vulnerability is fixed, ensuring that the __string() mechanism is properly applied in the tracing subsystem for KVM nested VM-Enter failure tracepoints. Specifically, they should: 1) Identify all systems running Linux kernels with KVM nested virtualization enabled, especially those using kvm-intel or kvm-amd as loadable modules. 2) Apply vendor-provided kernel updates or mainline kernel patches that address CVE-2021-47262. 3) If immediate patching is not feasible, consider disabling nested virtualization temporarily to mitigate risk. 4) Monitor kernel logs and tracing outputs for unusual tracepoint warnings or errors that may indicate attempts to trigger this vulnerability. 5) Limit local user privileges and restrict access to systems running nested virtualization to trusted personnel only. 6) Implement robust host-based intrusion detection to detect anomalous kernel behavior or crashes. 7) Coordinate with virtualization platform vendors to ensure compatibility and timely updates. These steps go beyond generic advice by focusing on the specific kernel modules and virtualization configurations involved.