CVE-2023-54008

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

virtio_vdpa: build affinity masks conditionally

We try to build affinity mask via create_affinity_masks()

unconditionally which may lead several issues:

- the affinity mask is not used for parent without affinity support

(only VDUSE support the affinity now)

- the logic of create_affinity_masks() might not work for devices

other than block. For example it's not rare in the networking device

where the number of queues could exceed the number of CPUs. Such

case breaks the current affinity logic which is based on

group_cpus_evenly() who assumes the number of CPUs are not less than

the number of groups. This can trigger a warning[1]:

if (ret >= 0)

WARN_ON(nr_present + nr_others < numgrps);

Fixing this by only build the affinity masks only when

- Driver passes affinity descriptor, driver like virtio-blk can make

sure to limit the number of queues when it exceeds the number of CPUs

- Parent support aff

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References