PCI Express Vulnerability in Integrity and Data Encryption Specification Allowing Tag Aliasing and Misdelivery of Completions

A vulnerability exists in the PCI Express (PCIe) Integrity and Data Encryption (IDE) specification, specifically in versions 5.0 and later. The issue arises from inadequate guidance on tag reuse following completion timeouts, which may permit multiple outstanding Non-Posted Requests to share the same tag. This tag aliasing can lead to completions being sent to the incorrect security context, potentially compromising data integrity and confidentiality.

Impact

The vulnerability can cause tag aliasing, allowing data completions to be misdirected to the wrong security contexts, which could corrupt data and violate confidentiality protections.

Remediation

Users can review and implement PCI-SIG Engineering Change Notifications (ECN) related to this vulnerability. Instructions for accessing these documents are available on the PCI-SIG website.