CVE-2024-35843
Severity CVSS v4.0:
Pending analysis
Type:
CWE-416
Use After Free
Publication date:
17/05/2024
Last modified:
07/04/2025
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
iommu/vt-d: Use device rbtree in iopf reporting path<br />
<br />
The existing I/O page fault handler currently locates the PCI device by<br />
calling pci_get_domain_bus_and_slot(). This function searches the list<br />
of all PCI devices until the desired device is found. To improve lookup<br />
efficiency, replace it with device_rbtree_find() to search the device<br />
within the probed device rbtree.<br />
<br />
The I/O page fault is initiated by the device, which does not have any<br />
synchronization mechanism with the software to ensure that the device<br />
stays in the probed device tree. Theoretically, a device could be released<br />
by the IOMMU subsystem after device_rbtree_find() and before<br />
iopf_get_dev_fault_param(), which would cause a use-after-free problem.<br />
<br />
Add a mutex to synchronize the I/O page fault reporting path and the IOMMU<br />
release device path. This lock doesn&#39;t introduce any performance overhead,<br />
as the conflict between I/O page fault reporting and device releasing is<br />
very rare.
Impact
Base Score 3.x
6.80
Severity 3.x
MEDIUM
Vulnerable products and versions
CPE | From | Up to |
---|---|---|
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.8.2 (excluding) |
To consult the complete list of CPE names with products and versions, see this page