CVE-2023-54043

Description

A linked list corruption flaw was found in the Linux kernel's iommufd subsystem. During HWPT (Hardware Page Table) specific attachment, the same hwpt can be added to the ioas->hwpt_list twice due to leftover code from a previous rework. This duplicate insertion corrupts the linked list structure, potentially causing crashes or undefined behavior.

Statement

This flaw affects systems using iommufd for IOMMU management, typically in virtualization environments with device passthrough. The list corruption occurs during specific HWPT attachment scenarios and requires the ability to interact with the iommufd interface, which typically needs elevated privileges.

Common Vulnerability Scoring System (CVSS) Score Details

Info alert:Important note

CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).

CVSS v3 Score Breakdown

Red HatNVDcve.org
Base Score5.5N/A8.8
Attack VectorLocalN/ALocal
Attack ComplexityLowN/ALow
Privileges RequiredLowN/ALow
User InteractionNoneN/ANone
ScopeUnchangedN/AChanged
ConfidentialityNoneN/AHigh
Integrity ImpactNoneN/AHigh
Availability ImpactHighN/AHigh

Vector

Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Understanding the Weakness (CWE)

CWE-694

Access Control

Technical Impact: Bypass Protection Mechanism

If unique identifiers are assumed when protecting sensitive resources, then duplicate identifiers might allow attackers to bypass the protection.

Other

Technical Impact: Quality Degradation

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.