CVE-2023-52910

In _allocandinsertiovarange, there is an issue that retrypfn overflows. The value of iovad->anchor.pfnhi is ~0UL, then when iovad->cachednode is iovad->anchor, curriova->pfnhi + 1 will overflow. As a result, if the retry logic is executed, lowpfn is updated to 0, and then newpfn < low_pfn returns false to make the allocation successful.

This issue occurs in the following two situations: 1. The first iova size exceeds the domain size. When initializing iova domain, iovad->cachednode is assigned as iovad->anchor. For example, the iova domain size is 10M, startpfn is 0x1F0000000, and the iova size allocated for the first time is 11M. The following is the log information, new->pfnlo is smaller than iovad->cachednode.

Example log as follows: [ 223.798112][T1705487] sh: [name:iova&]allocandinsertiovarange startpfn:0x1f0000,retrypfn:0x0,size:0xb00,limitpfn:0x1f0a00 [ 223.799590][T1705487] sh: [name:iova&]allocandinsertiovarange success startpfn:0x1f0000,new->pfnlo:0x1efe00,new->pfnhi:0x1f08ff

The node with the largest iova->pfnlo value in the iova domain is deleted, iovad->cachednode will be updated to iovad->anchor, and then the alloc iova size exceeds the maximum iova size that can be allocated in the domain.

After judging that retrypfn is less than limitpfn, call retry_pfn+1 to fix the overflow issue.

Database specific

{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/52xxx/CVE-2023-52910.json"
}

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

4e89dce725213d3d0b0475211b500eda4ef4bf2f

Fixed

c929a230c84441e400c32e7b7b4ab763711fb63e

Fixed

61cbf790e7329ed78877560be7136f0b911bba7f

Fixed

dcdb3ba7e2a8caae7bfefd603bc22fd0ce9a389c

Affected versions

v5.*

v5.10

v5.10-rc4

v5.10-rc5

v5.10-rc6

v5.10-rc7

v5.11

v5.11-rc1

v5.11-rc2

v5.11-rc3

v5.11-rc4

v5.11-rc5

v5.11-rc6

v5.11-rc7

v5.12

v5.12-rc1

v5.12-rc1-dontuse

v5.12-rc2

v5.12-rc3

v5.12-rc4

v5.12-rc5

v5.12-rc6

v5.12-rc7

v5.12-rc8

v5.13

v5.13-rc1

v5.13-rc2

v5.13-rc3

v5.13-rc4

v5.13-rc5

v5.13-rc6

v5.13-rc7

v5.14

v5.14-rc1

v5.14-rc2

v5.14-rc3

v5.14-rc4

v5.14-rc5

v5.14-rc6

v5.14-rc7

v5.15

v5.15-rc1

v5.15-rc2

v5.15-rc3

v5.15-rc4

v5.15-rc5

v5.15-rc6

v5.15-rc7

v5.15.1

v5.15.10

v5.15.11

v5.15.12

v5.15.13

v5.15.14

v5.15.15

v5.15.16

v5.15.17

v5.15.18

v5.15.19

v5.15.2

v5.15.20

v5.15.21

v5.15.22

v5.15.23

v5.15.24

v5.15.25

v5.15.26

v5.15.27

v5.15.28

v5.15.29

v5.15.3

v5.15.30

v5.15.31

v5.15.32

v5.15.33

v5.15.34

v5.15.35

v5.15.36

v5.15.37

v5.15.38

v5.15.39

v5.15.4

v5.15.40

v5.15.41

v5.15.42

v5.15.43

v5.15.44

v5.15.45

v5.15.46

v5.15.47

v5.15.48

v5.15.49

v5.15.5

v5.15.50

v5.15.51

v5.15.52

v5.15.53

v5.15.54

v5.15.55

v5.15.56

v5.15.57

v5.15.58

v5.15.59

v5.15.6

v5.15.60

v5.15.61

v5.15.62

v5.15.63

v5.15.64

v5.15.65

v5.15.66

v5.15.67

v5.15.68

v5.15.69

v5.15.7

v5.15.70

v5.15.71

v5.15.72

v5.15.73

v5.15.74

v5.15.75

v5.15.76

v5.15.77

v5.15.78

v5.15.79

v5.15.8

v5.15.80

v5.15.81

v5.15.82

v5.15.83

v5.15.84

v5.15.85

v5.15.86

v5.15.87

v5.15.88

v5.15.9

v5.16

v5.16-rc1

v5.16-rc2

v5.16-rc3

v5.16-rc4

v5.16-rc5

v5.16-rc6

v5.16-rc7

v5.16-rc8

v5.17

v5.17-rc1

v5.17-rc2

v5.17-rc3

v5.17-rc4

v5.17-rc5

v5.17-rc6

v5.17-rc7

v5.17-rc8

v5.18

v5.18-rc1

v5.18-rc2

v5.18-rc3

v5.18-rc4

v5.18-rc5

v5.18-rc6

v5.18-rc7

v5.19

v5.19-rc1

v5.19-rc2

v5.19-rc3

v5.19-rc4

v5.19-rc5

v5.19-rc6

v5.19-rc7

v5.19-rc8

v6.*

v6.0

v6.0-rc1

v6.0-rc2

v6.0-rc3

v6.0-rc4

v6.0-rc5

v6.0-rc6

v6.0-rc7

v6.1

v6.1-rc1

v6.1-rc2

v6.1-rc3

v6.1-rc4

v6.1-rc5

v6.1-rc6

v6.1-rc7

v6.1-rc8

v6.1.1

v6.1.2

v6.1.3

v6.1.4

v6.1.5

v6.1.6

v6.2-rc1

v6.2-rc2

v6.2-rc3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-52910.json"

vanir_signatures

[
    {
        "digest": {
            "line_hashes": [
                "331164490737932709382738841840521743503",
                "322655481134782513609083394469988925505",
                "145750324126279323683101160982625507634",
                "124654522755374146576810599641428743720",
                "164667092978119551462418122788380532543",
                "15771048002945246829079537686861749785",
                "220553932879020379632469381425892427338",
                "122006965820738957210256782391771237025"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2023-52910-02eec103",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@61cbf790e7329ed78877560be7136f0b911bba7f",
        "deprecated": false,
        "signature_version": "v1",
        "target": {
            "file": "drivers/iommu/iova.c"
        },
        "signature_type": "Line"
    },
    {
        "digest": {
            "line_hashes": [
                "331164490737932709382738841840521743503",
                "322655481134782513609083394469988925505",
                "145750324126279323683101160982625507634",
                "124654522755374146576810599641428743720",
                "164667092978119551462418122788380532543",
                "15771048002945246829079537686861749785",
                "220553932879020379632469381425892427338",
                "122006965820738957210256782391771237025"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2023-52910-67e10570",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dcdb3ba7e2a8caae7bfefd603bc22fd0ce9a389c",
        "deprecated": false,
        "signature_version": "v1",
        "target": {
            "file": "drivers/iommu/iova.c"
        },
        "signature_type": "Line"
    },
    {
        "digest": {
            "line_hashes": [
                "331164490737932709382738841840521743503",
                "322655481134782513609083394469988925505",
                "145750324126279323683101160982625507634",
                "124654522755374146576810599641428743720",
                "164667092978119551462418122788380532543",
                "15771048002945246829079537686861749785",
                "220553932879020379632469381425892427338",
                "122006965820738957210256782391771237025"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2023-52910-731263b0",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c929a230c84441e400c32e7b7b4ab763711fb63e",
        "deprecated": false,
        "signature_version": "v1",
        "target": {
            "file": "drivers/iommu/iova.c"
        },
        "signature_type": "Line"
    }
]

Git / github.com/gregkh/linux