GPU VulnDB

Database/Kernel, userspace & hypervisor

Linux kernel KVM device assignment IOMMU path virt/kvm/iommu.c - kvm_iommu_map_pages: When an IOMMU mapping fails

CVSS 7.8CVE-2014-3601Kernel, userspace & hypervisorcurated

Impact

When an IOMMU mapping fails partway through, KVM unwinds it with the wrong page count and corrupts host memory. A guest that supplies a large gfn drives the failure deliberately. This sits in the legacy KVM device-assignment code - the path used to give a VM a physical GPU - so the tenant's own act of attaching or reconfiguring its device is what triggers host memory corruption. It is also a good case study in patch discipline: the first fix was wrong and produced CVE-2014-8369, so operators who applied only the original are still exposed.

Who can reach it

Guest OS user on a host using KVM legacy device assignment with a passed-through PCI device.

What to do

Kernel upgrade that includes both commit 350b8bdd689cd2ab2c67c8a86a0be86cfa0751a7 (the original fix) and 3d32e4dbe71374a6780eaf51d719d76f9a9bf22f (the correction, CVE-2014-8369). Rolling reboot. Also worth noting as a fleet-modernisation argument: the legacy KVM device-assignment path this lives in was removed from the kernel in favour of VFIO, so hosts still using it are running a code path upstream no longer maintains.

References

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=350b8bdd689cd2ab2c67c8a86a0be86cfa0751a7https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3d32e4dbe71374a6780eaf51d719d76f9a9bf22fhttps://access.redhat.com/security/cve/CVE-2014-3601https://bugzilla.redhat.com/show_bug.cgi?id=1131951

Related entries

All Kernel, userspace & hypervisor entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.