CVE-2024-56669

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

iommu/vt-d: Remove cache tags before disabling ATS

The current implementation removes cache tags after disabling ATS,

leading to potential memory leaks and kernel crashes. Specifically,

CACHE_TAG_DEVTLB type cache tags may still remain in the list even

after the domain is freed, causing a use-after-free condition.

This issue really shows up when multiple VFs from different PFs

passed through to a single user-space process via vfio-pci. In such

cases, the kernel may crash with kernel messages like:

BUG: kernel NULL pointer dereference, address: 0000000000000014

PGD 19036a067 P4D 1940a3067 PUD 136c9b067 PMD 0

Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI

CPU: 74 UID: 0 PID: 3183 Comm: testCli Not tainted 6.11.9 #2

RIP: 0010:cache_tag_flush_range+0x9b/0x250

Call Trace:

<TASK>

? __die+0x1f/0x60

? page_fault_oops+0x163/0x590

? exc_page_fault+0x72/0x190

? asm_exc_page_fault+0x22/0x30

? cache_tag_flush_range+0

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References