cve-2024-35957
Vulnerability from cvelistv5
Published
2024-05-20 09:41
Modified
2024-08-02 03:21
Severity
Summary
iommu/vt-d: Fix WARN_ON in iommu probe path
References
SourceURLTags
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/89436f4f54125b1297aec1f466efd8acb4ec613d
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/fba8ca3e6f608b92e54271fdbd3ce569361939fc
Impacted products
VendorProduct
LinuxLinux
LinuxLinux
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-35957",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-20T14:23:39.677207Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:33:53.817Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:21:49.034Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/fba8ca3e6f608b92e54271fdbd3ce569361939fc"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/89436f4f54125b1297aec1f466efd8acb4ec613d"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/intel/iommu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "fba8ca3e6f60",
              "status": "affected",
              "version": "c618d446f1d6",
              "versionType": "git"
            },
            {
              "lessThan": "89436f4f5412",
              "status": "affected",
              "version": "1a75cc710b95",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/intel/iommu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6.8.7",
              "status": "affected",
              "version": "6.8.2",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/vt-d: Fix WARN_ON in iommu probe path\n\nCommit 1a75cc710b95 (\"iommu/vt-d: Use rbtree to track iommu probed\ndevices\") adds all devices probed by the iommu driver in a rbtree\nindexed by the source ID of each device. It assumes that each device\nhas a unique source ID. This assumption is incorrect and the VT-d\nspec doesn\u0027t state this requirement either.\n\nThe reason for using a rbtree to track devices is to look up the device\nwith PCI bus and devfunc in the paths of handling ATS invalidation time\nout error and the PRI I/O page faults. Both are PCI ATS feature related.\n\nOnly track the devices that have PCI ATS capabilities in the rbtree to\navoid unnecessary WARN_ON in the iommu probe path. Otherwise, on some\nplatforms below kernel splat will be displayed and the iommu probe results\nin failure.\n\n WARNING: CPU: 3 PID: 166 at drivers/iommu/intel/iommu.c:158 intel_iommu_probe_device+0x319/0xd90\n Call Trace:\n  \u003cTASK\u003e\n  ? __warn+0x7e/0x180\n  ? intel_iommu_probe_device+0x319/0xd90\n  ? report_bug+0x1f8/0x200\n  ? handle_bug+0x3c/0x70\n  ? exc_invalid_op+0x18/0x70\n  ? asm_exc_invalid_op+0x1a/0x20\n  ? intel_iommu_probe_device+0x319/0xd90\n  ? debug_mutex_init+0x37/0x50\n  __iommu_probe_device+0xf2/0x4f0\n  iommu_probe_device+0x22/0x70\n  iommu_bus_notifier+0x1e/0x40\n  notifier_call_chain+0x46/0x150\n  blocking_notifier_call_chain+0x42/0x60\n  bus_notify+0x2f/0x50\n  device_add+0x5ed/0x7e0\n  platform_device_add+0xf5/0x240\n  mfd_add_devices+0x3f9/0x500\n  ? preempt_count_add+0x4c/0xa0\n  ? up_write+0xa2/0x1b0\n  ? __debugfs_create_file+0xe3/0x150\n  intel_lpss_probe+0x49f/0x5b0\n  ? pci_conf1_write+0xa3/0xf0\n  intel_lpss_pci_probe+0xcf/0x110 [intel_lpss_pci]\n  pci_device_probe+0x95/0x120\n  really_probe+0xd9/0x370\n  ? __pfx___driver_attach+0x10/0x10\n  __driver_probe_device+0x73/0x150\n  driver_probe_device+0x19/0xa0\n  __driver_attach+0xb6/0x180\n  ? __pfx___driver_attach+0x10/0x10\n  bus_for_each_dev+0x77/0xd0\n  bus_add_driver+0x114/0x210\n  driver_register+0x5b/0x110\n  ? __pfx_intel_lpss_pci_driver_init+0x10/0x10 [intel_lpss_pci]\n  do_one_initcall+0x57/0x2b0\n  ? kmalloc_trace+0x21e/0x280\n  ? do_init_module+0x1e/0x210\n  do_init_module+0x5f/0x210\n  load_module+0x1d37/0x1fc0\n  ? init_module_from_file+0x86/0xd0\n  init_module_from_file+0x86/0xd0\n  idempotent_init_module+0x17c/0x230\n  __x64_sys_finit_module+0x56/0xb0\n  do_syscall_64+0x6e/0x140\n  entry_SYSCALL_64_after_hwframe+0x71/0x79"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-29T05:31:57.192Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/fba8ca3e6f608b92e54271fdbd3ce569361939fc"
        },
        {
          "url": "https://git.kernel.org/stable/c/89436f4f54125b1297aec1f466efd8acb4ec613d"
        }
      ],
      "title": "iommu/vt-d: Fix WARN_ON in iommu probe path",
      "x_generator": {
        "engine": "bippy-a5840b7849dd"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-35957",
    "datePublished": "2024-05-20T09:41:49.930Z",
    "dateReserved": "2024-05-17T13:50:33.136Z",
    "dateUpdated": "2024-08-02T03:21:49.034Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-35957\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-20T10:15:10.987\",\"lastModified\":\"2024-05-20T13:00:04.957\",\"vulnStatus\":\"Awaiting Analysis\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\niommu/vt-d: Fix WARN_ON in iommu probe path\\n\\nCommit 1a75cc710b95 (\\\"iommu/vt-d: Use rbtree to track iommu probed\\ndevices\\\") adds all devices probed by the iommu driver in a rbtree\\nindexed by the source ID of each device. It assumes that each device\\nhas a unique source ID. This assumption is incorrect and the VT-d\\nspec doesn\u0027t state this requirement either.\\n\\nThe reason for using a rbtree to track devices is to look up the device\\nwith PCI bus and devfunc in the paths of handling ATS invalidation time\\nout error and the PRI I/O page faults. Both are PCI ATS feature related.\\n\\nOnly track the devices that have PCI ATS capabilities in the rbtree to\\navoid unnecessary WARN_ON in the iommu probe path. Otherwise, on some\\nplatforms below kernel splat will be displayed and the iommu probe results\\nin failure.\\n\\n WARNING: CPU: 3 PID: 166 at drivers/iommu/intel/iommu.c:158 intel_iommu_probe_device+0x319/0xd90\\n Call Trace:\\n  \u003cTASK\u003e\\n  ? __warn+0x7e/0x180\\n  ? intel_iommu_probe_device+0x319/0xd90\\n  ? report_bug+0x1f8/0x200\\n  ? handle_bug+0x3c/0x70\\n  ? exc_invalid_op+0x18/0x70\\n  ? asm_exc_invalid_op+0x1a/0x20\\n  ? intel_iommu_probe_device+0x319/0xd90\\n  ? debug_mutex_init+0x37/0x50\\n  __iommu_probe_device+0xf2/0x4f0\\n  iommu_probe_device+0x22/0x70\\n  iommu_bus_notifier+0x1e/0x40\\n  notifier_call_chain+0x46/0x150\\n  blocking_notifier_call_chain+0x42/0x60\\n  bus_notify+0x2f/0x50\\n  device_add+0x5ed/0x7e0\\n  platform_device_add+0xf5/0x240\\n  mfd_add_devices+0x3f9/0x500\\n  ? preempt_count_add+0x4c/0xa0\\n  ? up_write+0xa2/0x1b0\\n  ? __debugfs_create_file+0xe3/0x150\\n  intel_lpss_probe+0x49f/0x5b0\\n  ? pci_conf1_write+0xa3/0xf0\\n  intel_lpss_pci_probe+0xcf/0x110 [intel_lpss_pci]\\n  pci_device_probe+0x95/0x120\\n  really_probe+0xd9/0x370\\n  ? __pfx___driver_attach+0x10/0x10\\n  __driver_probe_device+0x73/0x150\\n  driver_probe_device+0x19/0xa0\\n  __driver_attach+0xb6/0x180\\n  ? __pfx___driver_attach+0x10/0x10\\n  bus_for_each_dev+0x77/0xd0\\n  bus_add_driver+0x114/0x210\\n  driver_register+0x5b/0x110\\n  ? __pfx_intel_lpss_pci_driver_init+0x10/0x10 [intel_lpss_pci]\\n  do_one_initcall+0x57/0x2b0\\n  ? kmalloc_trace+0x21e/0x280\\n  ? do_init_module+0x1e/0x210\\n  do_init_module+0x5f/0x210\\n  load_module+0x1d37/0x1fc0\\n  ? init_module_from_file+0x86/0xd0\\n  init_module_from_file+0x86/0xd0\\n  idempotent_init_module+0x17c/0x230\\n  __x64_sys_finit_module+0x56/0xb0\\n  do_syscall_64+0x6e/0x140\\n  entry_SYSCALL_64_after_hwframe+0x71/0x79\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: iommu/vt-d: corrige WARN_ON en la ruta de sondeo de iommu. La confirmaci\u00f3n 1a75cc710b95 (\\\"iommu/vt-d: usa rbtree para rastrear los dispositivos sondeados por iommu\\\") agrega todos los dispositivos sondeados por iommu. controlador en un rbtree indexado por el ID de origen de cada dispositivo. Se supone que cada dispositivo tiene una identificaci\u00f3n de fuente \u00fanica. Esta suposici\u00f3n es incorrecta y la especificaci\u00f3n VT-d tampoco establece este requisito. La raz\u00f3n para usar un rbtree para rastrear dispositivos es buscar el dispositivo con bus PCI y devfunc en las rutas de manejo del error de tiempo de espera de invalidaci\u00f3n de ATS y las fallas de la p\u00e1gina PRI I/O. Ambos est\u00e1n relacionados con la funci\u00f3n PCI ATS. Realice un seguimiento \u00fanicamente de los dispositivos que tengan capacidades PCI ATS en el rbtree para evitar WARN_ON innecesario en la ruta de la sonda iommu. De lo contrario, en algunas plataformas inferiores al kernel se mostrar\u00e1 el s\u00edmbolo y la sonda iommu dar\u00e1 como resultado un error. ADVERTENCIA: CPU: 3 PID: 166 en drivers/iommu/intel/iommu.c:158 intel_iommu_probe_device+0x319/0xd90 Seguimiento de llamadas: ? __warn+0x7e/0x180 ? intel_iommu_probe_device+0x319/0xd90? report_bug+0x1f8/0x200? handle_bug+0x3c/0x70? exc_invalid_op+0x18/0x70? asm_exc_invalid_op+0x1a/0x20? intel_iommu_probe_device+0x319/0xd90? debug_mutex_init+0x37/0x50 __iommu_probe_device+0xf2/0x4f0 iommu_probe_device+0x22/0x70 iommu_bus_notifier+0x1e/0x40 notifier_call_chain+0x46/0x150 blocking_notifier_call_chain+0x42/0x60 bus_notify+0 x2f/0x50 device_add+0x5ed/0x7e0 platform_device_add+0xf5/0x240 mfd_add_devices+0x3f9/0x500 ? preempt_count_add+0x4c/0xa0? up_write+0xa2/0x1b0? __debugfs_create_file+0xe3/0x150 intel_lpss_probe+0x49f/0x5b0? pci_conf1_write+0xa3/0xf0 intel_lpss_pci_probe+0xcf/0x110 [intel_lpss_pci] pci_device_probe+0x95/0x120 really_probe+0xd9/0x370? __pfx___driver_attach+0x10/0x10 __driver_probe_device+0x73/0x150 driver_probe_device+0x19/0xa0 __driver_attach+0xb6/0x180 ? __pfx___driver_attach+0x10/0x10 bus_for_each_dev+0x77/0xd0 bus_add_driver+0x114/0x210 driver_register+0x5b/0x110 ? __pfx_intel_lpss_pci_driver_init+0x10/0x10 [intel_lpss_pci] do_one_initcall+0x57/0x2b0? kmalloc_trace+0x21e/0x280? do_init_module+0x1e/0x210 do_init_module+0x5f/0x210 load_module+0x1d37/0x1fc0 ? init_module_from_file+0x86/0xd0 init_module_from_file+0x86/0xd0 idempotent_init_module+0x17c/0x230 __x64_sys_finit_module+0x56/0xb0 do_syscall_64+0x6e/0x140 Entry_SYSCALL_64_after_hwframe+0x71 /0x79\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/89436f4f54125b1297aec1f466efd8acb4ec613d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/fba8ca3e6f608b92e54271fdbd3ce569361939fc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.