CVE-2023-54095: powerpc/iommu: Fix notifiers being shared by PCI and VIO buses
In the Linux kernel, the following vulnerability has been resolved:
powerpc/iommu: Fix notifiers being shared by PCI and VIO buses
failiommusetup() registers the failiommubusnotifier struct to both PCI and VIO buses. struct notifierblock is a linked list node, so this causes any notifiers later registered to either bus type to also be registered to the other since they share the same node.
This causes issues in (at least) the vgaarb code, which registers a notifier for PCI buses. pcinotify() ends up being called on a vio device, converted with topcidev() even though it's not a PCI device, and finally makes a bad access in vgaarbiteraddpcidevice() as discovered with KASAN:
BUG: KASAN: slab-out-of-bounds in vgaarbiteraddpcidevice+0x60/0xe00 Read of size 4 at addr c000000264c26fdc by task swapper/0/1
Call Trace: dumpstacklvl+0x1bc/0x2b8 (unreliable) printreport+0x3f4/0xc60 kasanreport+0x244/0x698 asanload4+0xe8/0x250 vgaarbiteraddpcidevice+0x60/0xe00 pcinotify+0x88/0x444 notifiercallchain+0x104/0x320 blockingnotifiercallchain+0xa0/0x140 deviceadd+0xac8/0x1d30 deviceregister+0x58/0x80 vioregisterdevicenode+0x9ac/0xce0 viobusscanregisterdevices+0xc4/0x13c machineinitcallpseriesviodeviceinit+0x94/0xf0 dooneinitcall+0x12c/0xaa8 kernelinitfreeable+0xa48/0xba8 kernelinit+0x64/0x400 retfromkernelthread+0x5c/0x64
Fix this by creating separate notifierblock structs for each bus type.
[mpe: Add #ifdef to fix CONFIGIBMVIO=n build]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Add #ifdef guards so the vga arbiter / VIO notifier code builds correctly when CONFIG_IBMVIO=n (per the referenced change: "Add #ifdef to fix CONFIG_IBMVIO=n build").
Linux kernel build CONFIG_IBMVIO = n - Configuration
Create separate notifier_block structs for each bus type (PCI and VIO) so PCI-notifier callbacks do not run for VIO devices and to prevent invalid device conversion in vga_arbiter_add_pci_device().
Linux kernel notifier handling (PCI and VIO buses) notifier_block sharing = separate per bus type
Event History
Frequently Asked Questions
What is the severity of CVE-2023-54095?
CVE-2023-54095 is classified as a moderate severity vulnerability due to its impact on kernel functions affecting PCI and VIO buses.
What systems are affected by CVE-2023-54095?
CVE-2023-54095 affects versions of the Linux kernel that utilize the powerpc architecture with IOMMU configurations.
How do I fix CVE-2023-54095?
To mitigate CVE-2023-54095, users should update their Linux kernel to the latest stable version where the vulnerability is resolved.
What are the potential impacts of CVE-2023-54095?
CVE-2023-54095 could lead to unreliable IOMMU notifications affecting device communication on affected systems.
Is there a workaround for CVE-2023-54095?
There are no known workarounds for CVE-2023-54095; the recommended approach is to apply the kernel update promptly.