CVE-2021-47140 is a medium-severity vulnerability in the Linux kernel related to the handling of DMA (Direct Memory Access) operations within the AMD IOMMU (Input-Output Memory Management Unit) subsystem. The vulnerability arises from improper clearing of dma_ops pointers when switching a device's IOMMU domain from a DMA domain to an identity domain. Specifically, since commit 08a27c1c3ecf5e1da193ce5f8fc97c3be16e75f0, Linux kernel code allowed users to switch devices between IOMMU and direct DMA domains via sysfs interfaces. However, for AMD IOMMU, the dma_ops structure was not cleared when switching to an identity domain, causing the DMA layer to incorrectly use dma-iommu operations on an identity domain. This leads to a NULL pointer dereference and kernel oops (crash) during device operations such as network driver initialization (e.g., e1000e driver). The root cause is that iommu_change_dev_def_domain() calls probe_finalize() again but fails to clear dma_ops as is done for Intel VT-d implementations. The impact is a denial-of-service condition due to kernel crashes triggered by unprivileged users manipulating sysfs entries to unbind and rebind devices with altered IOMMU group types. The vulnerability does not allow privilege escalation or data leakage but can cause system instability or downtime. The CVSS 3.1 score is 5.3 (medium), reflecting network attack vector, low complexity, no privileges required, no user interaction, and impact limited to availability. No known exploits are reported in the wild. The fix involves clearing dma_ops properly when switching domains for AMD IOMMU, aligning behavior with Intel VT-d handling.

For European organizations, this vulnerability primarily presents a risk of denial-of-service on Linux systems using AMD IOMMU hardware, particularly those that allow unprivileged users or containerized workloads to manipulate PCI device bindings via sysfs. A successful exploitation can cause kernel crashes leading to service interruptions, which may affect critical infrastructure, cloud services, or enterprise servers running Linux with AMD processors and IOMMU enabled. While it does not compromise confidentiality or integrity, availability impacts can disrupt business operations, especially in environments relying on high uptime such as financial institutions, telecommunications, and public services. Systems running network drivers like e1000e are specifically mentioned, so network-facing servers could be affected. The vulnerability requires local access to the system and the ability to write to sysfs PCI device interfaces, which may be restricted in hardened environments. However, in multi-tenant or shared hosting scenarios, this could be leveraged by malicious tenants to cause denial-of-service to co-resident workloads. The absence of known exploits reduces immediate risk but patching is recommended to prevent potential future abuse.

1. Apply the official Linux kernel patches that clear dma_ops correctly when switching IOMMU domains on AMD hardware. Ensure kernel versions include the fix from commit 08a27c1c3ecf5e1da193ce5f8fc97c3be16e75f0 or later. 2. Restrict write permissions to sysfs PCI device interfaces (/sys/bus/pci/devices/*) to trusted users only, preventing unprivileged users from unbinding and rebinding devices or changing IOMMU group types. 3. Harden container and virtualization environments to prevent escape or unauthorized sysfs access, especially where PCI passthrough or device assignment is used. 4. Monitor kernel logs for oops or crashes related to iommu_dma_alloc or e1000e driver initialization as indicators of attempted exploitation. 5. For critical systems, consider disabling AMD IOMMU if not required or using Intel VT-d if feasible, as the vulnerability is specific to AMD IOMMU implementation. 6. Implement system integrity monitoring and alerting for unexpected device binding changes. 7. Maintain up-to-date inventories of hardware and kernel versions to prioritize patching on affected AMD platforms.