In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
iommu\/vt-d: Clear Present bit before tearing down scalable-mode context entry<\/p>\n
device_pasid_table_teardown() zeroes the 128-bit scalable-mode context
\nentry with context_clear_entry() while the Present bit is still set. This
\ncreates a window where the hardware can fetch a torn entry, with some
\nfields already zeroed while Present is still set, leading to unpredictable
\nbehavior or spurious faults. The context-cache invalidation is issued only
\nafter the entry has been zeroed, and intel_pasid_free_table() then frees
\nthe PASID directory pages, so the IOMMU can keep walking a stale Present=1
\nentry that points at freed memory.<\/p>\n
While x86 provides strong write ordering, the compiler may reorder the two
\n64-bit writes to the entry, and the hardware fetch is not guaranteed to be
\natomic with respect to multiple CPU writes.<\/p>\n
Commit c1e4f1dccbe9d (“iommu\/vt-d: Clear Present bit before tearing down
\ncontext entry”) fixed this exact pattern in domain_context_clear_one() and
\nthe copied-context path, but device_pasid_table_teardown() was not
\nconverted.<\/p>\n
Align it with the “Guidance to Software for Invalidations” in the VT-d
\nspec, Section 6.5.3.3, using the same ownership handshake as the sibling
\nfix: clear only the Present bit, flush it to the IOMMU, perform the
\ncontext-cache invalidation, and only then zero the rest of the entry.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
iommu\/vt-d: Clear Present bit before tearing down scalable-mode context entry<\/p>\n
device_pasid_table_teardown() zeroes the 128-bit sca<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-7404","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/7404","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7404"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7404"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7404"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}