CVE-2023-52910

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

iommu/iova: Fix alloc iova overflows issue

In __alloc_and_insert_iova_range, there is an issue that retry_pfn

overflows. The value of iovad->anchor.pfn_hi is ~0UL, then when

iovad->cached_node is iovad->anchor, curr_iova->pfn_hi + 1 will

overflow. As a result, if the retry logic is executed, low_pfn is

updated to 0, and then new_pfn < low_pfn returns false to make the

allocation successful.

This issue occurs in the following two situations:

1. The first iova size exceeds the domain size. When initializing

iova domain, iovad->cached_node is assigned as iovad->anchor. For

example, the iova domain size is 10M, start_pfn is 0x1_F000_0000,

and the iova size allocated for the first time is 11M. The

following is the log information, new->pfn_lo is smaller than

iovad->cached_node.

Example log as follows:

[ 223.798112][T1705487] sh: [name:iova&]__alloc_and_insert_iova_range

start_pfn:0x1f0000,retry_pfn:0x0,size:0xb00,limit

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References