CVE-2023-53795

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

iommufd: IOMMUFD_DESTROY should not increase the refcount

syzkaller found a race where IOMMUFD_DESTROY increments the refcount:

obj = iommufd_get_object(ucmd->ictx, cmd->id, IOMMUFD_OBJ_ANY);

if (IS_ERR(obj))

return PTR_ERR(obj);

iommufd_ref_to_users(obj);

/* See iommufd_ref_to_users() */

if (!iommufd_object_destroy_user(ucmd->ictx, obj))

As part of the sequence to join the two existing primitives together.

Allowing the refcount the be elevated without holding the destroy_rwsem

violates the assumption that all temporary refcount elevations are

protected by destroy_rwsem. Racing IOMMUFD_DESTROY with

iommufd_object_destroy_user() will cause spurious failures:

WARNING: CPU: 0 PID: 3076 at drivers/iommu/iommufd/device.c:477 iommufd_access_destroy+0x18/0x20 drivers/iommu/iommufd/device.c:478

Modules linked in:

CPU: 0 PID: 3076 Comm: syz-executor.0 Not tainted 6.3

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References