Linux kernel (drivers/iommu/iommufd): The cache-invalidation ioctl calls a driver operation that may not exist, jumping

CVSS 6.5CVE-2024-46824Kernel, userspace & hypervisorcurated

Impact

The cache-invalidation ioctl calls a driver operation that may not exist, jumping through a NULL function pointer on a guest VMM's invalidation request. The host takes an unhandled fault at address zero inside the very path that is supposed to make a guest's IOMMU invalidations real, so the failure mode is both a node crash and an invalidation that never happened.

Who can reach it

A VMM holding /dev/iommu issuing IOMMU_HWPT_INVALIDATE - the nested-translation path qemu uses to forward a guest's IOTLB invalidations to hardware. No host root. Conditional on running nested translation on an IOMMU driver that never implemented the user-invalidation op; the upstream trace is qemu on arm64.

What to do

The record lists no fixed release; boot a kernel carrying the stable fix commits below. Interim control: do not enable nested translation / vIOMMU for tenant VMs on drivers that lack user cache invalidation, and keep /dev/iommu out of tenant containers.

References

https://git.kernel.org/stable/c/89827a4de802765b1ebb401fc1e73a90108c7520 https://git.kernel.org/stable/c/a11dda723c6493bb1853bbc61c093377f96e2d47 https://nvd.nist.gov/vuln/detail/CVE-2024-46824

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.