Xen - x86 IOMMU command timeout detection and handling: Xen's IOMMU command timeout handling is inappropriate, so IOMMU

Impact

Xen's IOMMU command timeout handling is inappropriate, so IOMMU operations that do not complete in time are mishandled. On a host doing PCI passthrough - which is every GPU cloud - the IOMMU is the component enforcing that an assigned device can only DMA into its owner's memory. Mishandled timeouts mean that enforcement can be left in an indeterminate state while devices keep running.

Who can reach it

Requires a guest able to generate IOMMU load, i.e. a guest with an assigned device doing heavy DMA - normal behaviour for a passed-through GPU or NIC.

What to do

Fixed in Xen (XSA-373). Hypervisor update plus host reboot. Especially relevant on GPU nodes, where passed-through accelerators and RDMA NICs push the IOMMU hard enough to hit timeout paths that idle hosts never reach.

References

Related entries

• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): An out-of-bounds access in the amdkfd (KFD computeCVE-2021-4460 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)High
• Xen (x86): Unintended memory sharing between guests - cross-tenant data exposureCVE-2022-42327 · Xen (x86)High
• Linux kernel (arch/x86/kvm): A guest that is not advertised long mode makes the host's SMM emulator walk 16CVE-2022-49883 · Linux kernel (arch/x86/kvm)High
• Linux kernel (drivers/vfio/pci/hisilicon): The VFIO migration save and resume paths do not advance the data pointer byCVE-2023-52453 · Linux kernel (drivers/vfio/pci/hisilicon)High
• Linux kernel (drivers/gpu/drm/vmwgfx): A tenant that asks for a fence event on its DRM fd and then reads the fd backCVE-2024-36960 · Linux kernel (drivers/gpu/drm/vmwgfx)High
• Linux kernel (drivers/iommu/iommufd): A tenant supplies an IOVA and user pointer whose alignment math overflows, soCVE-2024-47719 · Linux kernel (drivers/iommu/iommufd)High