CVE-2024-35843

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Use device rbtree in iopf reporting path The existing I/O page fault handler currently locates the PCI device by calling pci_get_domain_bus_and_slot(). This function searches the list of all PCI devices until the desired device is found. To improve lookup efficiency, replace it with device_rbtree_find() to search the device within the probed device rbtree. The I/O page fault is initiated by the device, which does not have any synchronization mechanism with the software to ensure that the device stays in the probed device tree. Theoretically, a device could be released by the IOMMU subsystem after device_rbtree_find() and before iopf_get_dev_fault_param(), which would cause a use-after-free problem. Add a mutex to synchronize the I/O page fault reporting path and the IOMMU release device path. This lock doesn't introduce any performance overhead, as the conflict between I/O page fault reporting and device releasing is very rare.

CVSS v3 6.8 MEDIUM

6.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.5 / Impact : 4.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://git.kernel.org/stable/c/3d39238991e745c5df85785604f037f35d9d1b15
https://git.kernel.org/stable/c/def054b01a867822254e1dda13d587f5c7a99e2a

Configurations

No configuration.

History

No history.

Information

Published : 2024-05-17 15:15

Updated : 2024-07-03 02:02

NVD link : CVE-2024-35843

Mitre link : CVE-2024-35843

CVE.ORG link : CVE-2024-35843

JSON object : View

Products Affected

No product.

CWE

CWE-416

Use After Free

{"id": "CVE-2024-35843", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 4.2, "exploitabilityScore": 2.5}]}, "published": "2024-05-17T15:15:21.313", "references": [{"url": "https://git.kernel.org/stable/c/3d39238991e745c5df85785604f037f35d9d1b15", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/def054b01a867822254e1dda13d587f5c7a99e2a", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-416"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/vt-d: Use device rbtree in iopf reporting path\n\nThe existing I/O page fault handler currently locates the PCI device by\ncalling pci_get_domain_bus_and_slot(). This function searches the list\nof all PCI devices until the desired device is found. To improve lookup\nefficiency, replace it with device_rbtree_find() to search the device\nwithin the probed device rbtree.\n\nThe I/O page fault is initiated by the device, which does not have any\nsynchronization mechanism with the software to ensure that the device\nstays in the probed device tree. Theoretically, a device could be released\nby the IOMMU subsystem after device_rbtree_find() and before\niopf_get_dev_fault_param(), which would cause a use-after-free problem.\n\nAdd a mutex to synchronize the I/O page fault reporting path and the IOMMU\nrelease device path. This lock doesn't introduce any performance overhead,\nas the conflict between I/O page fault reporting and device releasing is\nvery rare."}, {"lang": "es", "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: iommu/vt-d: use el rbtree del dispositivo en la ruta de informes iopf. El controlador de fallos de la p\u00e1gina de E/S existente actualmente ubica el dispositivo PCI llamando a pci_get_domain_bus_and_slot(). Esta funci\u00f3n busca en la lista de todos los dispositivos PCI hasta encontrar el dispositivo deseado. Para mejorar la eficiencia de la b\u00fasqueda, reempl\u00e1celo con device_rbtree_find() para buscar el dispositivo dentro del rbtree del dispositivo probado. El fallo de la p\u00e1gina de E/S la inicia el dispositivo, que no tiene ning\u00fan mecanismo de sincronizaci\u00f3n con el software para garantizar que el dispositivo permanezca en el \u00e1rbol de dispositivos analizados. En teor\u00eda, el subsistema IOMMU podr\u00eda liberar un dispositivo despu\u00e9s de device_rbtree_find() y antes de iopf_get_dev_fault_param(), lo que causar\u00eda un problema de uso despu\u00e9s de la liberaci\u00f3n. Agregue un mutex para sincronizar la ruta de informe de fallos de la p\u00e1gina de E/S y la ruta del dispositivo de liberaci\u00f3n IOMMU. Este bloqueo no introduce ninguna sobrecarga de rendimiento, ya que el conflicto entre el informe de fallos de la p\u00e1gina de E/S y la liberaci\u00f3n del dispositivo es muy raro."}], "lastModified": "2024-07-03T02:02:16.580", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}