Linux Kernel IOMMU Shift-Out-Of-Bounds Vulnerability in IOVA Bitmap Handling

A shift-out-of-bounds vulnerability has been identified in the Linux kernel's IOMMU fault handling, specifically within the IOVA bitmap management. This issue arises in the 'iova_bitmap_offset_to_index()' function, where the constant '1' (treated as a 32-bit integer) is shifted by 'bitmap->mapped.pgshift', an unsigned long value. If 'pgshift' exceeds 31, the operation can overflow, leading to undefined behavior. The vulnerability affects several versions of the Linux kernel.

Impact

Exploitation of this vulnerability could lead to undefined behavior in the kernel, potentially causing memory corruption or other unintended consequences.