CVE-2024-53232: iommu/s390: Implement blocking domain
In the Linux kernel, the following vulnerability has been resolved:
iommu/s390: Implement blocking domain
This fixes a crash when surprise hot-unplugging a PCI device. This crash happens because during hot-unplug iommugroupsetdomainnofail() attaching the default domain fails when the platform no longer recognizes the device as it has already been removed and we end up with a NULL domain pointer and UAF. This is exactly the case referred to in the second comment in iommudevicesetdomain() and just as stated there if we can instead attach the blocking domain the UAF is prevented as this can handle the already removed device. Implement the blocking domain to use this handling. With this change, the crash is fixed but we still hit a warning attempting to change DMA ownership on a blocked device.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1 - Upgrade
Upgrade
Linux kernel (iommu/s390)to a version that resolves this vulnerability.Patch iommu/s390: Implement blocking domain - Configuration
Implement/enable the blocking domain handling for affected iommu/s390 hot-unplug paths so that when attaching the default domain would fail after surprise hot-unplug, the blocking domain is attached to prevent NULL domain pointer and UAF.
Linux kernel (iommu/s390) default DMA/IOMMU domain handling for hot-unplugged PCI devices = attach blocking domain instead of default domain in __iommu_group_set_domain_nofail() / __iommu_device_set_domain() - Compensating control
If the kernel still emits a warning about changing DMA ownership on a blocked device, use operational monitoring/log review to identify affected hot-unplug events and mitigate by avoiding surprise hot-unplug of PCI devices until the warning/noise is addressed (the crash/UAF is fixed by attaching the blocking domain).
Event History
Frequently Asked Questions
What is the severity of CVE-2024-53232?
CVE-2024-53232 has been classified as a medium severity vulnerability affecting certain versions of the Linux kernel.
How do I fix CVE-2024-53232?
To fix CVE-2024-53232, you should upgrade to a patched version of the Linux kernel such as 5.10.223-1, 6.1.123-1, or 6.12.12-1.
What systems are affected by CVE-2024-53232?
CVE-2024-53232 affects Linux kernel versions from 6.7 up to 6.11.11 and versions from 6.12 to 6.12.2.
What is the impact of CVE-2024-53232?
The impact of CVE-2024-53232 is a crash that occurs when a PCI device is unexpectedly unplugged from the system.
Is there a workaround for CVE-2024-53232?
Currently, the recommended approach is to apply the available patches, as no specific workaround has been provided for CVE-2024-53232.