Linux kernel (drivers/iommu/iommufd): A tenant supplies an IOVA and user pointer whose alignment math overflows, so

CVSS 7.1CVE-2024-47719Kernel, userspace & hypervisorcurated

Impact

A tenant supplies an IOVA and user pointer whose alignment math overflows, so iommufd allocates the mapping area over a different IOVA range than the one it validated. A DMA window ends up somewhere the kernel did not intend it - the precondition for a passthrough device reaching memory outside its tenant's assignment.

Who can reach it

Any holder of /dev/iommu - a VMM for a passthrough VM, or a container handed the iommufd node - issuing IOMMU_IOAS_MAP with a crafted iova/user-pointer pair. Found by syzkaller, but the overflow is in the production area-allocation path (iopt_alloc_area_pages), not in test-only code; CONFIG_IOMMUFD_TEST only makes it visible as a WARN. No host root required.

What to do

The record lists no fixed release; boot a kernel carrying the stable fix commits below. Interim control: do not expose /dev/iommu to tenants; mediate DMA mapping through the host VMM rather than handing the fd into the guest's container.

References

https://git.kernel.org/stable/c/cd6dd564ae7d99967ef50078216929418160b30e https://git.kernel.org/stable/c/a6e9f9fd14772c0b23c6d1d7002d98f9d27cb1f6 https://nvd.nist.gov/vuln/detail/CVE-2024-47719

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.