CVE-2024-56668

What it actually does

Null pointer dereference in iommu/vt-d qi_batch allocation for nested parent domains causes kernel crash during page mapping operations via IOMMUFD.

Why it matters to the business

Virtualized workloads using IOMMU on affected Linux kernels can trigger system crashes and service disruption; low exploit likelihood reduces immediate risk but kernel updates remain necessary for stability.

How an attack unfolds

An attacker with local access triggers IOMMU page mapping through iommufd in a nested domain setup, such as via QEMU, hitting the uninitialized qi_batch pointer and causing a kernel NULL dereference.

How to fix it

Update the Linux kernel to a version containing commit ffd774c34774fd4cc0e9cf2976595623a6c3a077 or later; apply the qi_batch allocation helper to both parent and nested domain paths.

How to confirm the fix worked

Verify the kernel includes the referenced commit or later; reproduce page mapping in nested IOMMU domains and confirm absence of NULL dereference oops; monitor for stable qi_batch allocation under lock.

Typical attack path

1. Obtain local access on a system using Intel IOMMU with nested domains
2. Invoke IOMMUFD mapping operations that reach __cache_tag_assign_parent_domain
3. Trigger cache tag assignment without qi_batch allocation
4. Cause NULL dereference in cache_tag_flush_range_np during iotlb sync

How to detect it

Search kernel logs for oops messages referencing cache_tag_flush_range_np, intel_iommu_iotlb_sync_map, and qemu-system-x86; look for page fault at address 0000000000000200 during iommufd ioctl operations.

• BUG: kernel NULL pointer dereference, address: 0000000000000200
• cache_tag_flush_range_np+0x13c/0x260
• intel_iommu_iotlb_sync_map+0x1a/0x30
• iommufd_ioas_map
• qemu-system-x86

What your security team should do

• Prioritize kernel updates on systems using Intel VT-d IOMMU with nested domains
• Test IOMMUFD and virtualization workloads after patching
• Monitor kernel logs for related page fault oops until systems are updated