Linux Kernel IOMMU Debugfs Out-of-Bounds Access Vulnerability

A vulnerability in the Linux kernel's IOMMU debugfs for AMD can lead to out-of-bounds memory access. The issue arises in the 'iommu_mmio_write()' and 'iommu_capability_write()' functions, where the 'dbg_mmio_offset' and 'dbg_cap_offset' variables are declared as integers but are populated using 'kstrtou32_from_user()'. This can allow a user to input a large value that is interpreted as a negative integer, potentially causing an out-of-bounds access. Although the AMD IOMMU debugfs implementation had some protections in place, such as limiting user input to 8 bytes and catching negative values during read operations, these measures were not sufficient to prevent the vulnerability. The issue has been addressed by changing the input parsing function to 'kstrtos32_from_user()', which allows for the detection of negative values, and by adding explicit checks in the write functions to prevent out-of-bounds accesses.

Impact

Exploitation of this vulnerability could lead to out-of-bounds memory access, which may cause undefined behavior such as memory corruption or the introduction of security vulnerabilities.

Reproduction

The vulnerability can be reproduced by writing a value greater than 0xFFFFFFFF to the 'dbg_mmio_offset' or 'dbg_cap_offset' variables through the IOMMU debugfs interface. This will cause the values to be interpreted as negative integers, leading to out-of-bounds memory access.

Remediation

Users can upgrade to the patched version of the Linux kernel where this vulnerability has been addressed.