Bugzilla – Bug 1211597
VUL-0: CVE-2023-33250: kernel-source-azure,kernel-source-rt,kernel-source: use-after-free in iopt_unmap_iova_range in drivers/iommu/iommufd/io_pagetable.c
Last modified: 2024-05-07 11:39:45 UTC
CVE-2023-33250 The Linux kernel 6.3 has a use-after-free in iopt_unmap_iova_range in drivers/iommu/iommufd/io_pagetable.c. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-33250 https://www.cve.org/CVERecord?id=CVE-2023-33250 http://www.cvedetails.com/cve/CVE-2023-33250/ https://groups.google.com/g/syzkaller/c/G6P9yecsTZ8/m/iiqFVOM9BwAJ https://lore.kernel.org/linux-iommu/ZDabT%2FuRl%2FjxFhm0@ip-172-31-85-199.ec2.internal/T/
Reassigning to a concrete person to ensure progress [1] (feel free to pass to next one), see also the process at [2]. Looks like an syzbot report with no identified fix so far. Might be interesting to watch for Jöerg. [1] https://confluence.suse.com/display/KSS/Kernel+Security+Sentinel [2] https://wiki.suse.net/index.php/SUSE-Labs/Kernel/Security
51fe6141f0f6 (iommufd: Data structure to provide IOVA to PFN mapping) probably introduced the bug. This commit is very recent and would only make stable branch affected.
Joerg, are you aware of any fix for this report? Also is it really worth tracking as security relevant?
Upstream fixes are: dbe245cdf518 iommufd: Call iopt_area_contig_done() under the lock 804ca14d04df iommufd: Do not access the area pointer after unlocking Both are already in the stable branch via Linux 6.4.4 and in master branch via upstream. SLE branches are not affected as commit 51fe6141f0f6 is not included in any of them.
Assigning back.
nothing to do