CVE-2023-52455

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-52455
In the Linux kernel, the following vulnerability has been resolved: iommu: Don't reserve 0-length IOVA region When the bootloader/firmware doesn't setup the framebuffers, their address and size are 0 in "iommu-addresses" property. If IOVA region is reserved with 0 length, then it ends up corrupting the IOVA rbtree with an entry which has pfn_hi < pfn_lo. If we intend to use display driver in kernel without framebuffer then it's causing the display IOMMU mappings to fail as entire valid IOVA space is reserved when address and length are passed as 0. An ideal solution would be firmware removing the "iommu-addresses" property and corresponding "memory-region" if display is not present. But the kernel should be able to handle this by checking for size of IOVA region and skipping the IOVA reservation if size is 0. Also, add a warning if firmware is requesting 0-length IOVA region reservation.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/5e23e283910c9f30248732ae0770bcb0c9438abf Patch
https://git.kernel.org/stable/c/98b8a550da83cc392a14298c4b3eaaf0332ae6ad Patch
https://git.kernel.org/stable/c/bb57f6705960bebeb832142ce9abf43220c3eab1 Patch
https://git.kernel.org/stable/c/5e23e283910c9f30248732ae0770bcb0c9438abf Patch
https://git.kernel.org/stable/c/98b8a550da83cc392a14298c4b3eaaf0332ae6ad Patch
https://git.kernel.org/stable/c/bb57f6705960bebeb832142ce9abf43220c3eab1 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

21 Nov 2024, 08:39

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/5e23e283910c9f30248732ae0770bcb0c9438abf - Patch () https://git.kernel.org/stable/c/5e23e283910c9f30248732ae0770bcb0c9438abf - Patch
References () https://git.kernel.org/stable/c/98b8a550da83cc392a14298c4b3eaaf0332ae6ad - Patch () https://git.kernel.org/stable/c/98b8a550da83cc392a14298c4b3eaaf0332ae6ad - Patch
References () https://git.kernel.org/stable/c/bb57f6705960bebeb832142ce9abf43220c3eab1 - Patch () https://git.kernel.org/stable/c/bb57f6705960bebeb832142ce9abf43220c3eab1 - Patch

30 Apr 2024, 19:34

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
First Time Linux linux Kernel
Linux
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CWE NVD-CWE-noinfo
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: iommu: no reservar región IOVA de longitud 0 Cuando el gestor de arranque/firmware no configura los framebuffers, su dirección y tamaño son 0 en la propiedad "iommu-addresses". Si la región IOVA está reservada con una longitud de 0, termina corrompiendo el rbtree de IOVA con una entrada que tiene pfn_hi &lt; pfn_lo. Si pretendemos utilizar el controlador de pantalla en el kernel sin framebuffer, entonces las asignaciones IOMMU de pantalla fallarán ya que se reserva todo el espacio IOVA válido cuando la dirección y la longitud se pasan como 0. Una solución ideal sería que el firmware elimine la propiedad "iommu-addresses". y la "región de memoria" correspondiente si la pantalla no está presente. Pero el kernel debería poder manejar esto verificando el tamaño de la región IOVA y omitiendo la reserva de IOVA si el tamaño es 0. Además, agregue una advertencia si el firmware solicita una reserva de región IOVA de longitud 0.
References () https://git.kernel.org/stable/c/5e23e283910c9f30248732ae0770bcb0c9438abf - () https://git.kernel.org/stable/c/5e23e283910c9f30248732ae0770bcb0c9438abf - Patch
References () https://git.kernel.org/stable/c/98b8a550da83cc392a14298c4b3eaaf0332ae6ad - () https://git.kernel.org/stable/c/98b8a550da83cc392a14298c4b3eaaf0332ae6ad - Patch
References () https://git.kernel.org/stable/c/bb57f6705960bebeb832142ce9abf43220c3eab1 - () https://git.kernel.org/stable/c/bb57f6705960bebeb832142ce9abf43220c3eab1 - Patch

23 Feb 2024, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-23 15:15

Updated : 2024-11-21 08:39

NVD link : CVE-2023-52455

Mitre link : CVE-2023-52455

CVE.ORG link : CVE-2023-52455

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
NVD-CWE-noinfo