CVE-2023-53236

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

iommufd: Do not corrupt the pfn list when doing batch carry

If batch->end is 0 then setting npfns[0] before computing the new value of

pfns will fail to adjust the pfn and result in various page accounting

corruptions. It should be ordered after.

This seems to result in various kinds of page meta-data corruption related

failures:

WARNING: CPU: 1 PID: 527 at mm/gup.c:75 try_grab_folio+0x503/0x740

Modules linked in:

CPU: 1 PID: 527 Comm: repro Not tainted 6.3.0-rc2-eeac8ede1755+ #1

Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014

RIP: 0010:try_grab_folio+0x503/0x740

Code: e3 01 48 89 de e8 6d c1 dd ff 48 85 db 0f 84 7c fe ff ff e8 4f bf dd ff 49 8d 47 ff 48 89 45 d0 e9 73 fe ff ff e8 3d bf dd ff <0f> 0b 31 db e9 d0 fc ff ff e8 2f bf dd ff 48 8b 5d c8 31 ff 48 89

RSP: 0018:ffffc90000f37908 EFLAGS: 00010046

RAX: 0000000000000000 RBX: 000

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References