Linux kernel (drivers/iommu/amd): The AMD-Vi interrupt thread dereferences a NULL domain while reporting an IOMMU page

CVSS 5.5CVE-2023-53789Kernel, userspace & hypervisorcurated

Impact

The AMD-Vi interrupt thread dereferences a NULL domain while reporting an IOMMU page fault for a device group whose domain was never set up, oopsing the host from inside the fault handler. The faults themselves are generated by devices doing DMA to addresses they are not permitted to touch - exactly what a misbehaving or tenant-programmed device produces.

Who can reach it

An IOMMU page fault raised by a device whose group has no domain configured. A tenant holding a passthrough device can generate IOMMU faults freely by programming bad DMA addresses, but the 'no domain configured' precondition is host-side, so this is not a clean tenant-only path. AMD-Vi (EPYC) hosts; the upstream trace involves an amdgpu device.

What to do

The record lists no fixed release; boot a kernel carrying the stable fix commits below. Interim control: verify every passthrough group has a domain attached before exposing the device to a tenant.

References

https://git.kernel.org/stable/c/be8301e2d5a8b95c04ae8e35d7bfee7b0f03f83a https://git.kernel.org/stable/c/446080b353f048b1fddaec1434cb3d27b5de7efe https://nvd.nist.gov/vuln/detail/CVE-2023-53789

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.