Double list_add Vulnerability in iommu/vt-d Package
Summary
GSD-2022-1000780: iommu/vt-d: Fix double list_add when enabling VMD in scalable mode. Affects Kernel versions >= 474dd1c6506411752a9b2f2233eec11f1733a099, < 2aaa085bd012a83be7104356301828585a2253ed. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The iommu/vt-d package is a component of the Linux Kernel that provides support for Input-Output Memory Management Units (IOMMUs) and Virtualization Technology for Directed I/O (VT-d). IOMMUs are responsible for managing memory access and address translation for devices, while VT-d enables direct device assignment to virtual machines. These features are crucial for secure and efficient device virtualization in modern systems. However, a vulnerability has been discovered in the iommu/vt-d package that can lead to a double list_add when enabling VMD (Volume Management Device) in scalable mode.
Vulnerability Detail
The vulnerability in the iommu/vt-d package occurs due to a double list_add when enabling VMD in scalable mode. This issue can potentially lead to memory corruption or other unexpected behavior, which could be exploited by an attacker to gain unauthorized access, escalate privileges, or cause a denial of service. The vulnerability was introduced in version v5.14 of the Linux Kernel and has been fixed in version v5.15.27.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, as a general best practice, it is recommended to follow secure coding practices, regularly update the software components, and implement proper access controls to mitigate the risk of exploitation.
Conclusion
The double list_add vulnerability in the iommu/vt-d package can have serious security implications, potentially leading to unauthorized access, privilege escalation, or denial of service. It is crucial to update the Linux Kernel to version v5.15.27 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The iommu/vt-d package is a component of the Linux Kernel that provides support for Input-Output Memory Management Units (IOMMUs) and Virtualization Technology for Directed I/O (VT-d). It enables secure and efficient device virtualization in modern systems.
VMD (Volume Management Device) is a feature in the iommu/vt-d package that allows for scalable volume management in virtualized environments.
The vulnerability can lead to memory corruption or other unexpected behavior, which could be exploited by an attacker to gain unauthorized access, escalate privileges, or cause a denial of service.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.15.27 or later.
There is no specific workaround mentioned for this vulnerability. However, following secure coding practices, regularly updating software components, and implementing proper access controls can help mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
