CVE-2022-48916: Vulnerability in Linux Linux

Severity: highType: vulnerabilityCVE-2022-48916

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix double list_add when enabling VMD in scalable mode When enabling VMD and IOMMU scalable mode, the following kernel panic call trace/kernel log is shown in Eagle Stream platform (Sapphire Rapids CPU) during booting: pci 0000:59:00.5: Adding to iommu group 42 ... vmd 0000:59:00.5: PCI host bridge to bus 10000:80 pci 10000:80:01.0: [8086:352a] type 01 class 0x060400 pci 10000:80:01.0: reg 0x10: [mem 0x00000000-0x0001ffff 64bit] pci 10000:80:01.0: enabling Extended Tags pci 10000:80:01.0: PME# supported from D0 D3hot D3cold pci 10000:80:01.0: DMAR: Setup RID2PASID failed pci 10000:80:01.0: Failed to add to iommu group 42: -16 pci 10000:80:03.0: [8086:352b] type 01 class 0x060400 pci 10000:80:03.0: reg 0x10: [mem 0x00000000-0x0001ffff 64bit] pci 10000:80:03.0: enabling Extended Tags pci 10000:80:03.0: PME# supported from D0 D3hot D3cold ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:29! invalid opcode: 0000 [#1] PREEMPT SMP NOPTI CPU: 0 PID: 7 Comm: kworker/0:1 Not tainted 5.17.0-rc3+ #7 Hardware name: Lenovo ThinkSystem SR650V3/SB27A86647, BIOS ESE101Y-1.00 01/13/2022 Workqueue: events work_for_cpu_fn RIP: 0010:__list_add_valid.cold+0x26/0x3f Code: 9a 4a ab ff 4c 89 c1 48 c7 c7 40 0c d9 9e e8 b9 b1 fe ff 0f 0b 48 89 f2 4c 89 c1 48 89 fe 48 c7 c7 f0 0c d9 9e e8 a2 b1 fe ff <0f> 0b 48 89 d1 4c 89 c6 4c 89 ca 48 c7 c7 98 0c d9 9e e8 8b b1 fe RSP: 0000:ff5ad434865b3a40 EFLAGS: 00010246 RAX: 0000000000000058 RBX: ff4d61160b74b880 RCX: ff4d61255e1fffa8 RDX: 0000000000000000 RSI: 00000000fffeffff RDI: ffffffff9fd34f20 RBP: ff4d611d8e245c00 R08: 0000000000000000 R09: ff5ad434865b3888 R10: ff5ad434865b3880 R11: ff4d61257fdc6fe8 R12: ff4d61160b74b8a0 R13: ff4d61160b74b8a0 R14: ff4d611d8e245c10 R15: ff4d611d8001ba70 FS: 0000000000000000(0000) GS:ff4d611d5ea00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ff4d611fa1401000 CR3: 0000000aa0210001 CR4: 0000000000771ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> intel_pasid_alloc_table+0x9c/0x1d0 dmar_insert_one_dev_info+0x423/0x540 ? device_to_iommu+0x12d/0x2f0 intel_iommu_attach_device+0x116/0x290 __iommu_attach_device+0x1a/0x90 iommu_group_add_device+0x190/0x2c0 __iommu_probe_device+0x13e/0x250 iommu_probe_device+0x24/0x150 iommu_bus_notifier+0x69/0x90 blocking_notifier_call_chain+0x5a/0x80 device_add+0x3db/0x7b0 ? arch_memremap_can_ram_remap+0x19/0x50 ? memremap+0x75/0x140 pci_device_add+0x193/0x1d0 pci_scan_single_device+0xb9/0xf0 pci_scan_slot+0x4c/0x110 pci_scan_child_bus_extend+0x3a/0x290 vmd_enable_domain.constprop.0+0x63e/0x820 vmd_probe+0x163/0x190 local_pci_probe+0x42/0x80 work_for_cpu_fn+0x13/0x20 process_one_work+0x1e2/0x3b0 worker_thread+0x1c4/0x3a0 ? rescuer_thread+0x370/0x370 kthread+0xc7/0xf0 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x1f/0x30 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- ... Kernel panic - not syncing: Fatal exception Kernel Offset: 0x1ca00000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) ---[ end Kernel panic - not syncing: Fatal exception ]--- The following 'lspci' output shows devices '10000:80:*' are subdevices of the VMD device 0000:59:00.5: $ lspci ... 0000:59:00.5 RAID bus controller: Intel Corporation Volume Management Device NVMe RAID Controller (rev 20) ... 10000:80:01.0 PCI bridge: Intel Corporation Device 352a (rev 03) 10000:80:03.0 PCI bridge: Intel Corporation Device 352b (rev 03) 10000:80:05.0 PCI bridge: Intel Corporation Device 352c (rev 03) 10000:80:07.0 PCI bridge: Intel Corporation Device 352d (rev 03) 10000:81:00.0 Non-Volatile memory controller: Intel Corporation NVMe Datacenter SSD [3DNAND, Beta Rock Controller] 10000:82:00 ---truncated---

AI Analysis

Technical Summary

CVE-2022-48916 is a vulnerability in the Linux kernel related to the Intel IOMMU (Input-Output Memory Management Unit) VT-d implementation, specifically when enabling Volume Management Device (VMD) in scalable mode. The flaw arises from a double invocation of the list_add function during the initialization process, which leads to a kernel panic and system crash. This issue manifests on platforms using Intel Sapphire Rapids CPUs, such as the Eagle Stream platform, where the kernel log shows errors related to PCI device enumeration and IOMMU group management failures. The vulnerability is triggered during boot when the kernel attempts to add PCI devices to IOMMU groups, causing an invalid list operation that results in a BUG at lib/list_debug.c and a fatal kernel panic. The root cause is a programming error in the iommu/vt-d driver code that mishandles the list data structure when VMD and scalable mode are enabled concurrently. The impact is a denial of service (DoS) condition due to the kernel panic, which prevents the system from booting or operating normally. The vulnerability affects specific Linux kernel versions identified by commit hashes, and it is relevant for systems using Intel VMD hardware and the corresponding Linux kernel support. No known exploits are reported in the wild as of the publication date. The vulnerability does not have an assigned CVSS score but is recognized by the Linux project and CISA as a published security issue.

Potential Impact

For European organizations, this vulnerability poses a significant risk primarily to data centers, cloud providers, and enterprises running Linux servers on hardware platforms equipped with Intel Sapphire Rapids CPUs and utilizing VMD with IOMMU scalable mode enabled. The kernel panic triggered by this flaw results in a complete denial of service, causing system downtime and potential disruption of critical services. Organizations relying on high-availability Linux systems for virtualization, storage management, or PCI device isolation may experience operational interruptions. The inability to boot or maintain stable operation can lead to data unavailability, impacting business continuity and service level agreements. Although the vulnerability does not directly expose confidentiality or integrity risks, the availability impact is severe. Additionally, recovery from such kernel panics may require manual intervention or hardware resets, increasing operational overhead. Given the specialized hardware and configuration required to trigger this issue, the impact is more pronounced in environments with advanced server hardware deployments rather than general-purpose Linux desktops or laptops.

Mitigation Recommendations

To mitigate this vulnerability, European organizations should: 1) Apply the latest Linux kernel patches that address the double list_add bug in the iommu/vt-d driver as soon as they become available from trusted Linux kernel sources or their Linux distribution vendors. 2) Temporarily disable VMD or avoid enabling IOMMU scalable mode on affected hardware platforms until patches are applied, if feasible, to prevent triggering the kernel panic. 3) Conduct thorough testing of kernel updates in staging environments that replicate production hardware configurations involving Intel Sapphire Rapids CPUs and VMD to ensure stability before deployment. 4) Monitor kernel logs for signs of IOMMU group errors or PCI device enumeration failures that may indicate attempts to trigger this vulnerability. 5) Maintain updated hardware firmware and BIOS versions, as some platform-level fixes or workarounds may be provided by hardware vendors. 6) Implement robust system monitoring and automated recovery mechanisms to minimize downtime in case of unexpected kernel panics. 7) Coordinate with hardware vendors and Linux distribution maintainers for guidance and support related to this vulnerability and its mitigation.