CVE-2021-46943

What it actually does

Improper error handling in intel-ipu3 set_fmt allows invalid configuration to overwrite prior sizes, triggering 4 GiB buffer allocation that exhausts swiotlb/DMA space and produces a general protection fault.

Why it matters to the business

Local users can trigger kernel crashes and excessive memory consumption in systems using the intel-ipu3 media driver, resulting in denial of service and potential system instability; the issue is old with low exploit probability and no known active campaigns.

How an attack unfolds

An attacker with local access invokes a set_fmt operation on the intel-ipu3 device that fails partway through; the missing error-path guard allows the driver to apply an invalid large size, causing the kernel to request a 4 GiB DMA buffer that exhausts resources and crashes the system.

How to fix it

Update to a Linux kernel containing the fix for media: staging/intel-ipu3: Fix set_fmt error handling; rebuild and reboot with the corrected driver; disable the intel-ipu3 staging driver if the hardware is not required.

How to confirm the fix worked

Run v4l2-compliance against the intel-ipu3 device and confirm it no longer allocates 4 GiB or triggers the swiotlb/DMA fault; inspect kernel source for the error-handling guard around set_fmt and verify the commit is present.

Typical attack path

1. Obtain local user access on a Linux system with the intel-ipu3 driver loaded
2. Open a video device node controlled by the ipu3-imgu driver
3. Issue a VIDIOC_S_FMT ioctl that triggers an error during format validation
4. Observe the driver applying the invalid configuration and requesting a huge DMA buffer
5. Trigger swiotlb exhaustion leading to general protection fault and kernel oops

How to detect it

Search kernel logs (dmesg, journalctl) for the exact oops sequence mentioning ipu3-imgu, swiotlb buffer full, DMA out of SW-IOMMU space, and general protection fault; correlate with recent VIDIOC_S_FMT calls on video4linux devices.

• swiotlb buffer is full (sz: 4096 bytes)
• DMA: Out of SW-IOMMU space for 4096 bytes at device 0000:00:05.0
• general protection fault: 0000 [#1] PREEMPT SMP
• ipu3-imgu

What your security team should do

• Prioritize kernel update for any system exposing the intel-ipu3 driver to untrusted local users
• Audit logs for the specific oops strings on all hosts running affected kernels
• Consider blacklisting the staging/intel-ipu3 module where the hardware is unused