CVE-2023-52455

What it actually does

The flaw allows a 0-length IOVA region reservation from firmware-provided "iommu-addresses" properties to be inserted into the IOVA rbtree, creating an invalid entry where pfn_hi < pfn_lo and thereby corrupting the tree structure and preventing subsequent valid IOMMU mappings.

Why it matters to the business

Linux systems using IOMMU for display or graphics may experience complete failure of kernel display drivers, leading to loss of graphical output, reduced system functionality, and potential need for emergency kernel updates across fleets.

How an attack unfolds

An attacker with local access supplies or influences firmware/bootloader data that reports a 0-length framebuffer region in the device tree; the kernel then reserves this invalid region, corrupting the IOVA rbtree and causing IOMMU mapping requests to fail for display hardware.

How to fix it

Update the Linux kernel to a version containing commit 98b8a550da83cc392a14298c4b3eaaf0332ae6ad or later; rebuild and deploy the updated kernel image, then reboot affected systems.

How to confirm the fix worked

Verify the running kernel contains commit 98b8a550da83cc392a14298c4b3eaaf0332ae6ad via git log or kernel version string; test IOMMU initialization with a zero-length firmware region to confirm the reservation is skipped and no rbtree corruption occurs.

Typical attack path

1. Gain local access to a Linux system with IOMMU and display drivers enabled
2. Manipulate or provide firmware that populates "iommu-addresses" with address 0 and size 0
3. Trigger IOMMU initialization or display driver load
4. Observe IOVA rbtree corruption and subsequent mapping failures

How to detect it

Review kernel logs for IOVA rbtree corruption messages or warnings about 0-length reservations; inspect dmesg output during IOMMU and display driver initialization for signs of mapping failures.

What your security team should do

• Prioritize kernel updates on all systems exposing IOMMU and display hardware
• Audit bootloader and firmware configurations to ensure zero-length regions are not present
• Monitor kernel logs for IOVA reservation warnings after update