CVE-2022-48904

What it actually does

The IOMMU AMD driver updates the I/O page table mode for a domain before freeing the memory allocated for the page table entries, leaving the original allocations unreachable and causing a memory leak when pass-through devices are attached to VMs.

Why it matters to the business

Repeated VM launches with pass-through devices gradually exhaust kernel memory on affected Linux systems, potentially leading to degraded performance or denial of service for virtualization workloads; the issue is long-fixed in mainline and common distributions but still present on unpatched older kernels.

How an attack unfolds

An attacker or automated process repeatedly starts and stops VMs configured with AMD IOMMU pass-through devices; each cycle triggers the mode-update-before-free sequence, accumulating unreclaimed page table memory until the system becomes resource-starved.

How to fix it

Upgrade the Linux kernel to a version containing commit 378e2fe1eb58d5c2ed55c8fe5e11f9db5033cdd6 or later; for Android, ensure devices are running the 2021-11-01 or newer security patch level of Android 12 that includes the corrected IOMMU handling.

How to confirm the fix worked

After patching, boot a test VM with an AMD pass-through device, repeatedly start and stop the VM while monitoring kernel memory usage and IOMMU page table allocations via /proc or slabinfo to confirm leaks no longer occur.

Typical attack path

1. Identify or create a VM with direct device assignment on an AMD IOMMU system
2. Launch the VM, causing the domain to allocate a new I/O page table
3. Shut down or restart the VM, triggering the flawed mode-update path that leaks the table memory
4. Repeat the cycle to accelerate memory exhaustion

How to detect it

Review kernel logs and slab allocator statistics for sustained growth in IOMMU page table allocations correlated with VM start/stop events on AMD systems; no public exploit artifacts exist.

What your security team should do

• Prioritize kernel updates on any host running AMD IOMMU with virtualization pass-through workloads
• Add the fixed commit hash to internal patch scanners and SBOM checks
• Monitor memory usage trends on virtualization hosts as a compensating control until patches are applied