Executive Summary

This vulnerability exists in the Linux kernel's vfio/pci component. It involves the improper cleanup of DMABUFs (Direct Memory Access buffers) before disabling a device function during shutdown.

Specifically, the function vfio_pci_core_close_device() should call vfio_pci_dma_buf_cleanup() before the device function is disabled via vfio_pci_core_disable(). Without this cleanup, there is a small window where the device's Memory Space Enable (MSE) bit is cleared, but the device's Base Address Registers (BARs) can still be accessed through DMABUFs.

This means that resources could still be accessed or manipulated even though the function is supposed to be disabled, and those resources could be freed and potentially taken over by a different driver.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized access to device memory regions after the device function is supposed to be disabled.

Because the device's BARs remain accessible via DMABUFs during a small window, an attacker or malicious driver could potentially access or manipulate these resources, leading to data corruption, information leakage, or interference with device operation.

Additionally, since the resources could be freed and reassigned to a different driver, this could cause conflicts or security issues in the system.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability is fixed by ensuring that the Linux kernel calls vfio_pci_dma_buf_cleanup() before disabling the function via vfio_pci_core_disable() during device shutdown.

To mitigate this vulnerability, you should update your Linux kernel to a version that includes this fix.

Useful 0 Not Useful 0