Linux kernel (drivers/iommu/intel): Use-after-free of VT-d cache-tag objects. Device-TLB cache tags outlive the IOMMU

CVSS 8.8CVE-2024-56669Kernel, userspace & hypervisorcurated

Impact

Use-after-free of VT-d cache-tag objects. Device-TLB cache tags outlive the IOMMU domain they belong to, so a later IOTLB flush walks freed kernel memory. The upstream report reproduces it exactly as an operator would hit it - several VFs from different PFs passed through to one userspace process - and the crash arrives via the tenant's own DMA unmap ioctl. Scope-changed: a tenant's ordinary unmap corrupts host kernel state.

Who can reach it

A tenant process or VM holding /dev/vfio/* with one or more ATS-capable VFs assigned. The freed cache tag is reached from vfio_iommu_type1's VFIO_IOMMU_UNMAP_DMA path, i.e. an ioctl the tenant issues itself. Conditional on Intel VT-d with device-TLB/ATS enabled on the assigned functions. No host root required.

What to do

The record lists no fixed release; boot a kernel carrying the stable fix commits below. Interim controls: avoid assigning VFs from multiple different PFs to a single tenant, and disable ATS on assigned functions where the device allows it.

References

https://git.kernel.org/stable/c/9a0a72d3ed919ebe6491f527630998be053151d8 https://git.kernel.org/stable/c/1f2557e08a617a4b5e92a48a1a9a6f86621def18 https://nvd.nist.gov/vuln/detail/CVE-2024-56669

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.