Executive brief
A vulnerability in the Linux kernel's handling of Intel hardware components could allow a local user to crash the system. When certain hardware devices are disconnected or reset while the system is running, the kernel may enter an infinite loop trying to communicate with the missing device. This results in a complete system hang or 'hard lockup,' impacting the availability of the server or workstation.
Technical details
A flaw exists in the iommu/vt-d component of the Linux kernel. When a PCIe device connected via a hotplug-capable port is reset or disconnected, the pciehp driver unloads the device driver and powers it off. However, the IOMMU driver may still attempt to issue an Address Translation Service (ATS) Invalidation request (device-TLB invalidation) to the now-disconnected device. This triggers an Invalidation Time-out Error (ITE) fault in an interrupt context, causing the kernel to enter a 'deadly loop' of retries. This infinite retry loop results in a hard lockup and kernel panic, effectively a local Denial of Service. The issue has been resolved in multiple stable kernel branches by ensuring invalidation requests are not issued to disconnected devices.
Affected products
- Linux Linux Kernel 5.16 to 6.6.23, 6.7 to 6.7.11
Timeline
- 2024-03-26: patched: Fix committed to Linux stable tree
- 2024-04-17: disclosed: CVE published
References
- https://git.kernel.org/stable/c/025bc6b41e020aeb1e71f84ae3ffce945026de05
- https://git.kernel.org/stable/c/2b74b2a92e524d7c8dec8e02e95ecf18b667c062
- https://git.kernel.org/stable/c/34a7b30f56d30114bf4d436e4dc793afe326fbcf
- https://git.kernel.org/stable/c/4fc82cd907ac075648789cc3a00877778aa1838b
- https://git.kernel.org/stable/c/c04f2780919f20e2cc4846764221f5e802555868
- https://git.kernel.org/stable/c/d70f1c85113cd8c2aa8373f491ca5d1b22ec0554
- https://git.kernel.org/stable/c/f873b85ec762c5a6abe94a7ddb31df5d3ba07d85