CVE-2023-54137

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

vfio/type1: fix cap_migration information leak

Fix an information leak where an uninitialized hole in struct

vfio_iommu_type1_info_cap_migration on the stack is exposed to userspace.

The definition of struct vfio_iommu_type1_info_cap_migration contains a hole as

shown in this pahole(1) output:

struct vfio_iommu_type1_info_cap_migration {

struct vfio_info_cap_header header; /* 0 8 */

__u32 flags; /* 8 4 */

/* XXX 4 bytes hole, try to pack */

__u64 pgsize_bitmap; /* 16 8 */

__u64 max_dirty_bitmap_size; /* 24 8 */

/* size: 32, cachelines: 1, members: 4 */

/* sum members: 28, holes: 1, sum holes: 4 */

/* last cacheline: 32 bytes */

};

The cap_mig variable is filled in without initializing the hole:

stati

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References