by Kastro
Paper/Archive/CVE-2023-52801

CVE-2023-52801

Linux Linux — iommufd: Fix missing update of domains_itree after splitting iopt_area

EPSS 0.6%CVSS 9.1
critical.is priorityof 100
37
CVSS 9.1 (ADP)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 48.4.484 × 209.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix missing update of domains_itree after splitting iopt_area In iopt_area_split(), if the original iopt_area has filled a domain and is linked to domains_itree, pages_nodes have to be properly reinserted. Otherwise the domains_itree becomes corrupted and we will UAF.

Affected

ProductAffectedFixed inSource
Linux51fe6141f0f64ae0bbc096a41a07572273e8c0ef – < 836db2e7e4565d8218923b3552304a1637e2f28d836db2e7e4565d8218923b3552304a1637e2f28dCNA
Linux51fe6141f0f64ae0bbc096a41a07572273e8c0ef – < fcb32111f01ddf3cbd04644cde1773428e31de6afcb32111f01ddf3cbd04644cde1773428e31de6aCNA
Linux51fe6141f0f64ae0bbc096a41a07572273e8c0ef – < e7250ab7ca4998fe026f2149805b03e09dc32498e7250ab7ca4998fe026f2149805b03e09dc32498CNA
Linux6.26.5.13CNA
linux_kernel51fe6141f0f6 – < 836db2e7e456836db2e7e456CISA-ADP
linux_kernel51fe6141f0f6 – < fcb32111f01dfcb32111f01dCISA-ADP
linux_kernel51fe6141f0f6 – < e7250ab7ca49e7250ab7ca49CISA-ADP
linux_kernel6..2–CISA-ADP
linux_kernelsee advisory–CISA-ADP
linux_kernelsee advisory6.5.13CISA-ADP
linux_kernelsee advisory6.6.3CISA-ADP
linux_kernelsee advisory6.7CISA-ADP

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Linux (CNA)8.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refgit.kernel.org/stable/c/836db2e7e4565d8218923b3552304a1637e2f28drefgit.kernel.org/stable/c/fcb32111f01ddf3cbd04644cde1773428e31de6arefgit.kernel.org/stable/c/e7250ab7ca4998fe026f2149805b03e09dc32498