{"timestamp":"2024-09-10T15:34:52.014408Z","id":"CVE-2023-52910","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/iommu/iova.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4e89dce725213d3d0b0475211b500eda4ef4bf2f","lessThan":"c929a230c84441e400c32e7b7b4ab763711fb63e","versionType":"git","status":"affected"},{"version":"4e89dce725213d3d0b0475211b500eda4ef4bf2f","lessThan":"61cbf790e7329ed78877560be7136f0b911bba7f","versionType":"git","status":"affected"},{"version":"4e89dce725213d3d0b0475211b500eda4ef4bf2f","lessThan":"dcdb3ba7e2a8caae7bfefd603bc22fd0ce9a389c","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/iommu/iova.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.11","status":"affected"},{"version":"0","lessThan":"5.11","versionType":"semver","status":"unaffected"},{"version":"5.15.89","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.7","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]

NIST AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

NIST NVD-CWE-noinfo

OR
     *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.89
     *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.7
     *cpe:2.3:o:linux:linux_kernel:6.2:rc1:*:*:*:*:*:*
     *cpe:2.3:o:linux:linux_kernel:6.2:rc2:*:*:*:*:*:*
     *cpe:2.3:o:linux:linux_kernel:6.2:rc3:*:*:*:*:*:*

https://git.kernel.org/stable/c/61cbf790e7329ed78877560be7136f0b911bba7f No Types Assigned

https://git.kernel.org/stable/c/61cbf790e7329ed78877560be7136f0b911bba7f Patch

https://git.kernel.org/stable/c/c929a230c84441e400c32e7b7b4ab763711fb63e No Types Assigned

https://git.kernel.org/stable/c/c929a230c84441e400c32e7b7b4ab763711fb63e Patch

https://git.kernel.org/stable/c/dcdb3ba7e2a8caae7bfefd603bc22fd0ce9a389c No Types Assigned

https://git.kernel.org/stable/c/dcdb3ba7e2a8caae7bfefd603bc22fd0ce9a389c Patch

In the Linux kernel, the following vulnerability has been resolved:

iommu/iova: Fix alloc iova overflows issue

In __alloc_and_insert_iova_range, there is an issue that retry_pfn
overflows. The value of iovad->anchor.pfn_hi is ~0UL, then when
iovad->cached_node is iovad->anchor, curr_iova->pfn_hi + 1 will
overflow. As a result, if the retry logic is executed, low_pfn is
updated to 0, and then new_pfn < low_pfn returns false to make the
allocation successful.

This issue occurs in the following two situations:
1. The first iova size exceeds the domain size. When initializing
iova domain, iovad->cached_node is assigned as iovad->anchor. For
example, the iova domain size is 10M, start_pfn is 0x1_F000_0000,
and the iova size allocated for the first time is 11M. The
following is the log information, new->pfn_lo is smaller than
iovad->cached_node.

Example log as follows:
[  223.798112][T1705487] sh: [name:iova&]__alloc_and_insert_iova_range
start_pfn:0x1f0000,retry_pfn:0x0,size:0xb00,limit_pfn:0x1f0a00
[  223.799590][T1705487] sh: [name:iova&]__alloc_and_insert_iova_range
success start_pfn:0x1f0000,new->pfn_lo:0x1efe00,new->pfn_hi:0x1f08ff

2. The node with the largest iova->pfn_lo value in the iova domain
is deleted, iovad->cached_node will be updated to iovad->anchor,
and then the alloc iova size exceeds the maximum iova size that can
be allocated in the domain.

After judging that retry_pfn is less than limit_pfn, call retry_pfn+1
to fix the overflow issue.

kernel.org https://git.kernel.org/stable/c/61cbf790e7329ed78877560be7136f0b911bba7f [No types assigned]

kernel.org https://git.kernel.org/stable/c/c929a230c84441e400c32e7b7b4ab763711fb63e [No types assigned]

kernel.org https://git.kernel.org/stable/c/dcdb3ba7e2a8caae7bfefd603bc22fd0ce9a389c [No types assigned]