Executive Summary

This vulnerability exists in the Linux kernel's iommu/dma subsystem, specifically in the function iommu_dma_iova_link_swiotlb(). The function processes memory mappings in three parts: head, middle, and trailer. When the middle part is empty due to no aligned pages, the code incorrectly calls iommu_map() with a size of 0, which is illegal and causes the iommupt implementation to fail.

Following this failure, the error handling attempts to unwind the mapping starting from the wrong position, which corrupts the mapping. This corruption eventually triggers a WARN_ON during destruction.

The fix involves checking for a 0 length before mapping and avoiding such mapping calls, as well as using the correct offset instead of zero as the starting point to unlink.

This issue is often triggered by certain Thunderbolt NVMe drives that cause forced SWIOTLB usage for unaligned memory, as NVMe passes oddly aligned buffers for passthrough commands (e.g., from smartctl) that hit this condition.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause corruption in the IOMMU mapping when handling certain unaligned memory regions, particularly with some Thunderbolt NVMe drives. The corrupted mapping can lead to kernel warnings (WARN_ON) and potentially unstable behavior in the kernel's DMA subsystem.

While the description does not explicitly mention security impacts such as privilege escalation or denial of service, the corruption of memory mappings in the kernel could lead to system instability or crashes, which may affect system reliability.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is triggered by certain unaligned memory mappings in the Linux kernel's iommu/dma subsystem, often when using some kinds of thunderbolt NVMe drives that force SWIOTLB for unaligned memory.

Detection could involve monitoring for kernel WARN_ON messages related to iommu mapping errors, especially those triggered by NVMe passthrough commands such as those from smartctl.

You can check your system logs (e.g., using dmesg or journalctl) for WARN_ON messages related to iommu or swiotlb.

• dmesg | grep -i 'iommu'
• journalctl -k | grep -i 'WARN_ON'
• smartctl commands on thunderbolt NVMe drives might trigger the issue, so monitoring smartctl output and kernel logs during such operations could help detect the vulnerability.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability has been resolved by modifying the Linux kernel to avoid attempting to iommu_map a 0 length region and to correctly handle offsets when unlinking.

Immediate mitigation steps include updating your Linux kernel to a version that contains this fix.

Until the kernel is updated, avoid using thunderbolt NVMe drives or operations that trigger forced SWIOTLB with unaligned memory mappings, such as certain smartctl passthrough commands.

Useful 0 Not Useful 0