CVE-2023-52474

published 2024-02-26

CVE-2023-52474: In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Fix bugs with non-PAGE_SIZE-end multi-iovec user SDMA requests hfi1 user SDMA…

Priority P3 41 high 7.8 CVSS 3.1

AV L AC L PR L UI N S U C H I H A H

In the Linux kernel, the following vulnerability has been resolved:

IB/hfi1: Fix bugs with non-PAGE_SIZE-end multi-iovec user SDMA requests

hfi1 user SDMA request processing has two bugs that can cause data
corruption for user SDMA requests that have multiple payload iovecs
where an iovec other than the tail iovec does not run up to the page
boundary for the buffer pointed to by that iovec.a

Here are the specific bugs:
1. user_sdma_txadd() does not use struct user_sdma_iovec->iov.iov_len.
Rather, user_sdma_txadd() will add up to PAGE_SIZE bytes from iovec
to the packet, even if some of those bytes are past
iovec->iov.iov_len and are thus not intended to be in the packet.
2. user_sdma_txadd() and user_sdma_send_pkts() fail to advance to the
next iovec in user_sdma_request->iovs when the current iovec
is not PAGE_SIZE and does not contain enough data to complete the
packet. The transmitted packet will contain the wrong data from the
iovec pages.

This has not been an issue with SDMA packets from hfi1 Verbs or PSM2
because they only produce iovecs that end short of PAGE_SIZE as the tail
iovec of an SDMA request.

Fixing these bugs exposes other bugs with the SDMA pin cache
(struct mmu_rb_handler) that get in way of supporting user SDMA requests
with multiple payload iovecs whose buffers do not end at PAGE_SIZE. So
this commit fixes those issues as well.

Here are the mmu_rb_handler bugs that non-PAGE_SIZE-end multi-iovec
payload user SDMA requests can hit:
1. Overlapping memory ranges in mmu_rb_handler will result in duplicate
pinnings.
2. When extending an existing mmu_rb_handler entry (struct mmu_rb_node),
the mmu_rb code (1) removes the existing entry under a lock, (2)
releases that lock, pins the new pages, (3) then reacquires the lock
to insert the extended mmu_rb_node.

If someone else comes in and inserts an overlapping entry between (2)
and (3), insert in (3) will fail.

The failure path code in this case unpins _all_ pages in either the
original mmu_rb_node

Affected

17 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 6.1.37-1 (bookworm)	linux 6.1.37-1 (bookworm)
linux	linux	—	—
linux	linux	>= 7724105686e718ac476a6ad3304fea2fbcfcffde < 9c4c6512d7330b743c4ffd18bd999a86ca26db0d	9c4c6512d7330b743c4ffd18bd999a86ca26db0d
linux	linux	>= 7724105686e718ac476a6ad3304fea2fbcfcffde < a2bd706ab63509793b5cd5065e685b7ef5cba678	a2bd706ab63509793b5cd5065e685b7ef5cba678
linux	linux	>= 7724105686e718ac476a6ad3304fea2fbcfcffde < dce59b5443700fbd0d2433ec6e4d4cf063448844	dce59b5443700fbd0d2433ec6e4d4cf063448844
linux	linux	>= 7724105686e718ac476a6ad3304fea2fbcfcffde < c76cb8f4bdf26d04cfa5485a93ce297dba5e6a80	c76cb8f4bdf26d04cfa5485a93ce297dba5e6a80
linux	linux	>= 7724105686e718ac476a6ad3304fea2fbcfcffde < 7e6010f79b58f45b204cf18aa58f4b73c3f30adc	7e6010f79b58f45b204cf18aa58f4b73c3f30adc
linux	linux	>= 7724105686e718ac476a6ad3304fea2fbcfcffde < 00cbce5cbf88459cd1aa1d60d0f1df15477df127	00cbce5cbf88459cd1aa1d60d0f1df15477df127
linux	linux_kernel	>= 0 < 5.10.191-1	5.10.191-1
linux	linux_kernel	>= 0 < 6.1.37-1	6.1.37-1
linux	linux_kernel	>= 0 < 6.3.7-1	6.3.7-1
linux	linux_kernel	>= 0 < 6.3.7-1	6.3.7-1
linux	linux_kernel	>= 4.3.0 < 5.10.180	5.10.180
linux	linux_kernel	>= 5.11.0 < 5.15.111	5.15.111
linux	linux_kernel	>= 5.16.0 < 6.1.28	6.1.28
linux	linux_kernel	>= 6.2.0 < 6.2.15	6.2.15
linux	linux_kernel	>= 6.3.0 < 6.3.2	6.3.2

CVSS provenance

nvd v3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

osv 7.8 HIGH

vendor_debian 7.8 HIGH

vendor_redhat 7.8 HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.