Linux kernel (drivers/iommu): The IOVA allocator's retry path overflows, so the lower-bound check is made against zero

CVSS 8.8CVE-2023-52910Kernel, userspace & hypervisorcurated

Impact

The IOVA allocator's retry path overflows, so the lower-bound check is made against zero and an allocation succeeds with an IOVA below the domain's start address. A DMA address gets handed out outside the range the domain was set up to cover - an address the IOMMU domain does not actually own, which is the shape of a DMA window pointing where it should not. Vendor scores it scope-changed.

Who can reach it

Reached when an IOVA allocation request exceeds the size of the domain's address space, or when the node with the largest address is removed and a subsequent oversized allocation runs the retry path. Driven by in-kernel DMA API users through dma-iommu, so it is the host's device drivers on the hot path rather than a tenant ioctl - a tenant influences it only indirectly, through I/O sizes and mapping churn.

What to do

The record lists no fixed release; boot a kernel carrying the stable fix commits below. No useful interim control - the allocator is shared by every DMA API user on the node.

References

https://git.kernel.org/stable/c/c929a230c84441e400c32e7b7b4ab763711fb63e https://git.kernel.org/stable/c/61cbf790e7329ed78877560be7136f0b911bba7f https://nvd.nist.gov/vuln/detail/CVE-2023-52910

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.