Linux kernel KVM device assignment IOMMU path virt/kvm/iommu.c - kvm_iommu_map_pages: When an IOMMU mapping fails

Impact

When an IOMMU mapping fails partway through, KVM unwinds it with the wrong page count and corrupts host memory. A guest that supplies a large gfn drives the failure deliberately. This sits in the legacy KVM device-assignment code - the path used to give a VM a physical GPU - so the tenant's own act of attaching or reconfiguring its device is what triggers host memory corruption. It is also a good case study in patch discipline: the first fix was wrong and produced CVE-2014-8369, so operators who applied only the original are still exposed.

Who can reach it

Guest OS user on a host using KVM legacy device assignment with a passed-through PCI device.

What to do

Kernel upgrade that includes both commit 350b8bdd689cd2ab2c67c8a86a0be86cfa0751a7 (the original fix) and 3d32e4dbe71374a6780eaf51d719d76f9a9bf22f (the correction, CVE-2014-8369). Rolling reboot. Also worth noting as a fleet-modernisation argument: the legacy KVM device-assignment path this lives in was removed from the kernel in favour of VFIO, so hosts still using it are running a code path upstream no longer maintains.

References