In the Linux kernel, the following vulnerability has been resolved:
vfio/type1: prevent underflow of locked_vm via exec()
When a vfio container is preserved across exec, the task does not change, but it gets a new mm with lockedvm=0, and loses the count from existing dma mappings. If the user later unmaps a dma mapping, lockedvm underflows to a large unsigned value, and a subsequent dma map request fails with ENOMEM in _accountlocked_vm.
To avoid underflow, grab and save the mm at the time a dma is mapped. Use that mm when adjusting locked_vm, rather than re-acquiring the saved task's mm, which may have changed. If the saved mm is dead, do nothing.
locked_vm is incremented for existing mappings in a subsequent patch.
{ "vanir_signatures": [ { "id": "CVE-2023-53171-08462f8a", "signature_type": "Function", "target": { "file": "drivers/vfio/vfio_iommu_type1.c", "function": "vfio_iommu_type1_dma_rw_chunk" }, "signature_version": "v1", "digest": { "length": 1126.0, "function_hash": "313221757732504022156903414381924354440" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eafb81c50da899dd80b340c841277acc4a1945b7" }, { "id": "CVE-2023-53171-0e0ab4f4", "signature_type": "Function", "target": { "file": "drivers/vfio/vfio_iommu_type1.c", "function": "vfio_pin_page_external" }, "signature_version": "v1", "digest": { "length": 701.0, "function_hash": "299850402727684665898925301820686877610" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eafb81c50da899dd80b340c841277acc4a1945b7" }, { "id": "CVE-2023-53171-1dca0600", "signature_type": "Function", "target": { "file": "drivers/vfio/vfio_iommu_type1.c", "function": "vfio_dma_do_map" }, "signature_version": "v1", "digest": { "length": 1607.0, "function_hash": "283118851897271977981146148459016473549" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5a271242716846cc016736fb76be2b40ee49b0c3" }, { "id": "CVE-2023-53171-2331d868", "signature_type": "Function", "target": { "file": "drivers/vfio/vfio_iommu_type1.c", "function": "vfio_pin_page_external" }, "signature_version": "v1", "digest": { "length": 701.0, "function_hash": "299850402727684665898925301820686877610" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5a271242716846cc016736fb76be2b40ee49b0c3" }, { "id": "CVE-2023-53171-233e207e", "signature_type": "Function", "target": { "file": "drivers/vfio/vfio_iommu_type1.c", "function": "vfio_iommu_type1_dma_rw_chunk" }, "signature_version": "v1", "digest": { "length": 1126.0, "function_hash": "313221757732504022156903414381924354440" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@046eca5018f8a5dd1dc2cedf87fb5843b9ea3026" }, { "id": "CVE-2023-53171-238c0972", "signature_type": "Function", "target": { "file": "drivers/vfio/vfio_iommu_type1.c", "function": "vfio_pin_page_external" }, "signature_version": "v1", "digest": { "length": 701.0, "function_hash": "299850402727684665898925301820686877610" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@046eca5018f8a5dd1dc2cedf87fb5843b9ea3026" }, { "id": "CVE-2023-53171-24934638", "signature_type": "Function", "target": { "file": "drivers/vfio/vfio_iommu_type1.c", "function": "vfio_dma_do_map" }, "signature_version": "v1", "digest": { "length": 2042.0, "function_hash": "227813302386579757274274982196932159049" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b0790dff0760b7734cf0961f497ad64628ca550b" }, { "id": "CVE-2023-53171-2b190911", "signature_type": "Line", "target": { "file": "drivers/vfio/vfio_iommu_type1.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "22206875720158041932440561434012475797", "242818107353805477976575137059445652966", "173199916689893094871218013905039978032", "299154749808805012539906859411256001071", "154555639710031884837130456190512825831", "90209570870529123758255196011268442893", "225566884919036841711841034678419691522", "139800901965797136903622539496708723265", "327388889230083604240581360930972467748", "133034997041499697583663741414618976851", "306343332809040478256771080365385479263", "83553081839181459875988179138583659067", "26926357483830844988769345964808181715", "189262367374400178720676042176761468719", "307627613835084088049862788117620597328", "181132101697826303681338413119789232409", "254067072191473722574555508130431743301", "23280357523385782892590120749434641945", "208977212206389232035137317681104131389", "269954418656497711584546378776016908884", "285865868637142166422402272000527361907", "82747095780405235832550354144252353059", "63941959158343106256434154992835067330", "313801698679211709639903454007950625264", "267319535325277048298229934551942236504", "297325057602553302626000465428182019181", "94580626684194057073894824521061641176", "124704687217714797204827086812403741795", "135718158810398959518667743604076468709", "292443781205674598207291674730722016485", "268852536754406544526769250910039003969", "193020057005078484242498398673280413565", "130657316552855854760193408794880520306" ], "threshold": 0.9 }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5a271242716846cc016736fb76be2b40ee49b0c3" }, { "id": "CVE-2023-53171-33542a2d", "signature_type": "Function", "target": { "file": "drivers/vfio/vfio_iommu_type1.c", "function": "vfio_remove_dma" }, "signature_version": "v1", "digest": { "length": 374.0, "function_hash": "187511033009126538383027203924300272866" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@046eca5018f8a5dd1dc2cedf87fb5843b9ea3026" }, { "id": "CVE-2023-53171-4d28cb7a", "signature_type": "Function", "target": { "file": "drivers/vfio/vfio_iommu_type1.c", "function": "vfio_lock_acct" }, "signature_version": "v1", "digest": { "length": 419.0, "function_hash": "149036684335775531667729951363302117051" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@046eca5018f8a5dd1dc2cedf87fb5843b9ea3026" }, { "id": "CVE-2023-53171-575bead6", "signature_type": "Line", "target": { "file": "drivers/vfio/vfio_iommu_type1.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "186641585771134632062565766991321855937", "242818107353805477976575137059445652966", "173199916689893094871218013905039978032", "299154749808805012539906859411256001071", "154555639710031884837130456190512825831", "90209570870529123758255196011268442893", "225566884919036841711841034678419691522", "139800901965797136903622539496708723265", "327388889230083604240581360930972467748", "133034997041499697583663741414618976851", "306343332809040478256771080365385479263", "83553081839181459875988179138583659067", "26926357483830844988769345964808181715", "189262367374400178720676042176761468719", "307627613835084088049862788117620597328", "181132101697826303681338413119789232409", "254067072191473722574555508130431743301", "23280357523385782892590120749434641945", "208977212206389232035137317681104131389", "269954418656497711584546378776016908884", "51666301703488678286301169437424886090", "100989167092312729769862178116739875283", "63941959158343106256434154992835067330", "313801698679211709639903454007950625264", "267319535325277048298229934551942236504", "297325057602553302626000465428182019181", "94580626684194057073894824521061641176", "12111651165346584379828229055357037805", "135718158810398959518667743604076468709", "292443781205674598207291674730722016485", "268852536754406544526769250910039003969", "193020057005078484242498398673280413565", "130657316552855854760193408794880520306" ], "threshold": 0.9 }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@046eca5018f8a5dd1dc2cedf87fb5843b9ea3026" }, { "id": "CVE-2023-53171-5f7d21e6", "signature_type": "Function", "target": { "file": "drivers/vfio/vfio_iommu_type1.c", "function": "vfio_remove_dma" }, "signature_version": "v1", "digest": { "length": 374.0, "function_hash": "187511033009126538383027203924300272866" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eafb81c50da899dd80b340c841277acc4a1945b7" }, { "id": "CVE-2023-53171-61c9a663", "signature_type": "Function", "target": { "file": "drivers/vfio/vfio_iommu_type1.c", "function": "vfio_lock_acct" }, "signature_version": "v1", "digest": { "length": 419.0, "function_hash": "149036684335775531667729951363302117051" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b0790dff0760b7734cf0961f497ad64628ca550b" }, { "id": "CVE-2023-53171-61fce100", "signature_type": "Function", "target": { "file": "drivers/vfio/vfio_iommu_type1.c", "function": "vfio_pin_page_external" }, "signature_version": "v1", "digest": { "length": 701.0, "function_hash": "299850402727684665898925301820686877610" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b0790dff0760b7734cf0961f497ad64628ca550b" }, { "id": "CVE-2023-53171-667e0922", "signature_type": "Line", "target": { "file": "drivers/vfio/vfio_iommu_type1.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "186641585771134632062565766991321855937", "242818107353805477976575137059445652966", "173199916689893094871218013905039978032", "299154749808805012539906859411256001071", "154555639710031884837130456190512825831", "90209570870529123758255196011268442893", "225566884919036841711841034678419691522", "139800901965797136903622539496708723265", "327388889230083604240581360930972467748", "133034997041499697583663741414618976851", "306343332809040478256771080365385479263", "83553081839181459875988179138583659067", "26926357483830844988769345964808181715", "189262367374400178720676042176761468719", "307627613835084088049862788117620597328", "181132101697826303681338413119789232409", "254067072191473722574555508130431743301", "23280357523385782892590120749434641945", "208977212206389232035137317681104131389", "269954418656497711584546378776016908884", "51666301703488678286301169437424886090", "100989167092312729769862178116739875283", "63941959158343106256434154992835067330", "313801698679211709639903454007950625264", "267319535325277048298229934551942236504", "297325057602553302626000465428182019181", "94580626684194057073894824521061641176", "12111651165346584379828229055357037805", "135718158810398959518667743604076468709", "292443781205674598207291674730722016485", "268852536754406544526769250910039003969", "193020057005078484242498398673280413565", "130657316552855854760193408794880520306" ], "threshold": 0.9 }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b0790dff0760b7734cf0961f497ad64628ca550b" }, { "id": "CVE-2023-53171-6c6247ab", "signature_type": "Line", "target": { "file": "drivers/vfio/vfio_iommu_type1.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "186641585771134632062565766991321855937", "242818107353805477976575137059445652966", "173199916689893094871218013905039978032", "299154749808805012539906859411256001071", "154555639710031884837130456190512825831", "90209570870529123758255196011268442893", "225566884919036841711841034678419691522", "139800901965797136903622539496708723265", "327388889230083604240581360930972467748", "133034997041499697583663741414618976851", "306343332809040478256771080365385479263", "83553081839181459875988179138583659067", "26926357483830844988769345964808181715", "189262367374400178720676042176761468719", "307627613835084088049862788117620597328", "181132101697826303681338413119789232409", "254067072191473722574555508130431743301", "23280357523385782892590120749434641945", "208977212206389232035137317681104131389", "269954418656497711584546378776016908884", "51666301703488678286301169437424886090", "100989167092312729769862178116739875283", "63941959158343106256434154992835067330", "313801698679211709639903454007950625264", "267319535325277048298229934551942236504", "297325057602553302626000465428182019181", "94580626684194057073894824521061641176", "12111651165346584379828229055357037805", "135718158810398959518667743604076468709", "292443781205674598207291674730722016485", "268852536754406544526769250910039003969", "193020057005078484242498398673280413565", "130657316552855854760193408794880520306" ], "threshold": 0.9 }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a6b2aabe664098d5cf877ae0fd96459464a30e17" }, { "id": "CVE-2023-53171-726d592b", "signature_type": "Function", "target": { "file": "drivers/vfio/vfio_iommu_type1.c", "function": "vfio_dma_do_map" }, "signature_version": "v1", "digest": { "length": 2027.0, "function_hash": "293174023509421513887972460241645387267" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eafb81c50da899dd80b340c841277acc4a1945b7" }, { "id": "CVE-2023-53171-79d44880", "signature_type": "Function", "target": { "file": "drivers/vfio/vfio_iommu_type1.c", "function": "vfio_remove_dma" }, "signature_version": "v1", "digest": { "length": 374.0, "function_hash": "187511033009126538383027203924300272866" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a6b2aabe664098d5cf877ae0fd96459464a30e17" }, { "id": "CVE-2023-53171-7d949448", "signature_type": "Function", "target": { "file": "drivers/vfio/vfio_iommu_type1.c", "function": "vfio_iommu_type1_dma_rw_chunk" }, "signature_version": "v1", "digest": { "length": 1126.0, "function_hash": "313221757732504022156903414381924354440" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b0790dff0760b7734cf0961f497ad64628ca550b" }, { "id": "CVE-2023-53171-812fe804", "signature_type": "Function", "target": { "file": "drivers/vfio/vfio_iommu_type1.c", "function": "vfio_dma_do_map" }, "signature_version": "v1", "digest": { "length": 2042.0, "function_hash": "227813302386579757274274982196932159049" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a6b2aabe664098d5cf877ae0fd96459464a30e17" }, { "id": "CVE-2023-53171-92519f0c", "signature_type": "Function", "target": { "file": "drivers/vfio/vfio_iommu_type1.c", "function": "vfio_remove_dma" }, "signature_version": "v1", "digest": { "length": 374.0, "function_hash": "187511033009126538383027203924300272866" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b0790dff0760b7734cf0961f497ad64628ca550b" }, { "id": "CVE-2023-53171-9c7e168b", "signature_type": "Function", "target": { "file": "drivers/vfio/vfio_iommu_type1.c", "function": "vfio_lock_acct" }, "signature_version": "v1", "digest": { "length": 419.0, "function_hash": "149036684335775531667729951363302117051" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eafb81c50da899dd80b340c841277acc4a1945b7" }, { "id": "CVE-2023-53171-ab6f1f20", "signature_type": "Function", "target": { "file": "drivers/vfio/vfio_iommu_type1.c", "function": "vfio_iommu_type1_dma_rw_chunk" }, "signature_version": "v1", "digest": { "length": 1126.0, "function_hash": "313221757732504022156903414381924354440" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a6b2aabe664098d5cf877ae0fd96459464a30e17" }, { "id": "CVE-2023-53171-c109babf", "signature_type": "Function", "target": { "file": "drivers/vfio/vfio_iommu_type1.c", "function": "vfio_pin_page_external" }, "signature_version": "v1", "digest": { "length": 701.0, "function_hash": "299850402727684665898925301820686877610" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a6b2aabe664098d5cf877ae0fd96459464a30e17" }, { "id": "CVE-2023-53171-cca49313", "signature_type": "Function", "target": { "file": "drivers/vfio/vfio_iommu_type1.c", "function": "vfio_remove_dma" }, "signature_version": "v1", "digest": { "length": 269.0, "function_hash": "239589122877044931492688854749120019921" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5a271242716846cc016736fb76be2b40ee49b0c3" }, { "id": "CVE-2023-53171-d763d2bc", "signature_type": "Line", "target": { "file": "drivers/vfio/vfio_iommu_type1.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "186641585771134632062565766991321855937", "242818107353805477976575137059445652966", "173199916689893094871218013905039978032", "299154749808805012539906859411256001071", "154555639710031884837130456190512825831", "90209570870529123758255196011268442893", "225566884919036841711841034678419691522", "139800901965797136903622539496708723265", "327388889230083604240581360930972467748", "133034997041499697583663741414618976851", "306343332809040478256771080365385479263", "83553081839181459875988179138583659067", "26926357483830844988769345964808181715", "189262367374400178720676042176761468719", "307627613835084088049862788117620597328", "181132101697826303681338413119789232409", "254067072191473722574555508130431743301", "23280357523385782892590120749434641945", "208977212206389232035137317681104131389", "269954418656497711584546378776016908884", "51666301703488678286301169437424886090", "100989167092312729769862178116739875283", "63941959158343106256434154992835067330", "313801698679211709639903454007950625264", "267319535325277048298229934551942236504", "297325057602553302626000465428182019181", "94580626684194057073894824521061641176", "124704687217714797204827086812403741795", "135718158810398959518667743604076468709", "292443781205674598207291674730722016485", "268852536754406544526769250910039003969", "193020057005078484242498398673280413565", "130657316552855854760193408794880520306" ], "threshold": 0.9 }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eafb81c50da899dd80b340c841277acc4a1945b7" }, { "id": "CVE-2023-53171-dc94425f", "signature_type": "Function", "target": { "file": "drivers/vfio/vfio_iommu_type1.c", "function": "vfio_iommu_type1_dma_rw_chunk" }, "signature_version": "v1", "digest": { "length": 1109.0, "function_hash": "200079964003879834618358906645720532401" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5a271242716846cc016736fb76be2b40ee49b0c3" }, { "id": "CVE-2023-53171-dd449a11", "signature_type": "Function", "target": { "file": "drivers/vfio/vfio_iommu_type1.c", "function": "vfio_lock_acct" }, "signature_version": "v1", "digest": { "length": 419.0, "function_hash": "149036684335775531667729951363302117051" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5a271242716846cc016736fb76be2b40ee49b0c3" }, { "id": "CVE-2023-53171-ecc7185a", "signature_type": "Function", "target": { "file": "drivers/vfio/vfio_iommu_type1.c", "function": "vfio_lock_acct" }, "signature_version": "v1", "digest": { "length": 419.0, "function_hash": "149036684335775531667729951363302117051" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a6b2aabe664098d5cf877ae0fd96459464a30e17" }, { "id": "CVE-2023-53171-f0148589", "signature_type": "Function", "target": { "file": "drivers/vfio/vfio_iommu_type1.c", "function": "vfio_dma_do_map" }, "signature_version": "v1", "digest": { "length": 2042.0, "function_hash": "227813302386579757274274982196932159049" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@046eca5018f8a5dd1dc2cedf87fb5843b9ea3026" } ] }