CVE-2023-52801 - iommufd: Fix missing update of domains_itree after splitting iopt_area

Back Back to CVE browser

CRITICAL

iommufd: Fix missing update of domains_itree after splitting iopt_area

Published May 21, 2024

9.1

CRITICAL

CVSS 3.1

EPSS 0.60%

Description

In iopt_area_split(), if the original iopt_area has filled a domain and is linked to domains_itree, pages_nodes have to be properly reinserted. Otherwise the domains_itree becomes corrupted and we will UAF.

Affected products

Vendor Linux Product Linux Default
unaffected
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
Vendor Linux Product Linux Default
affected
- Version
  6.2
  Status
  affected
  Constraints
  -
- Version
  0
  Status
  unaffected
  Constraints
  <6.2
- Version
  6.5.13
  Status
  unaffected
  Constraints
  <=6.5.*
- Version
  6.6.3
  Status
  unaffected
  Constraints
  <=6.6.*
- Version
  6.7
  Status
  unaffected
  Constraints
  <=*

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Linux

unaffected

Version	Status	Constraints
	affected
	affected
	affected

Linux

affected

Version	Status	Constraints
6.2	affected	-
0	unaffected	<6.2
6.5.13	unaffected	<=6.5.*
6.6.3	unaffected	<=6.6.*
6.7	unaffected	<=*

Vendor Linux Product Linux Kernel Default
n/a
- Version
  51fe6141f0f6
  Status
  affected
  Constraints
  <836db2e7e456
- Version
  51fe6141f0f6
  Status
  affected
  Constraints
  <e7250ab7ca49
- Version
  51fe6141f0f6
  Status
  affected
  Constraints
  <fcb32111f01d
Vendor Linux Product Linux Kernel Default
n/a
- Version
  6..2
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Linux

Linux Kernel

n/a

Version	Status	Constraints
51fe6141f0f6	affected	<836db2e7e456
51fe6141f0f6	affected	<e7250ab7ca49
51fe6141f0f6	affected	<fcb32111f01d

Linux

Linux Kernel

n/a

Version	Status	Constraints
6..2	affected	-

Red Hat Enterprise Linux 9

kernel-0:5.14.0-427.35.1.el9_4

Fixed · RHSA-2024:6567
Red Hat Enterprise Linux 9

kernel-0:5.14.0-427.35.1.el9_4

Fixed · RHSA-2024:6567
Red Hat Enterprise Linux 6

kernel

Not affected
Red Hat Enterprise Linux 7

kernel

Not affected
Red Hat Enterprise Linux 7

kernel-rt

Not affected
Red Hat Enterprise Linux 8

kernel

Not affected
Red Hat Enterprise Linux 8

kernel-rt

Not affected
Red Hat Enterprise Linux 9

kernel-rt

Affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 9	kernel-0:5.14.0-427.35.1.el9_4	Fixed	RHSA-2024:6567
Red Hat Enterprise Linux 9	kernel-0:5.14.0-427.35.1.el9_4	Fixed	RHSA-2024:6567
Red Hat Enterprise Linux 6	kernel	Not affected	n/a
Red Hat Enterprise Linux 7	kernel	Not affected	n/a
Red Hat Enterprise Linux 7	kernel-rt	Not affected	n/a
Red Hat Enterprise Linux 8	kernel	Not affected	n/a
Red Hat Enterprise Linux 8	kernel-rt	Not affected	n/a
Red Hat Enterprise Linux 9	kernel-rt	Affected	n/a

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-284

CWE-99

References (9)

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2023-52801		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2282709		Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-59518		Advisory
https://git.kernel.org/stable/c/836db2e7e4565d8218923b3552304a1637e2f28d		Patch
https://git.kernel.org/stable/c/e7250ab7ca4998fe026f2149805b03e09dc32498		Patch
https://git.kernel.org/stable/c/fcb32111f01ddf3cbd04644cde1773428e31de6a		Patch
https://lore.kernel.org/linux-cve-announce/2024052159-CVE-2023-52801-b287@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2023-52801
https://www.cve.org/CVERecord?id=CVE-2023-52801