CVE-2024-56669

What it actually does

The flaw removes cache tags after disabling ATS, allowing CACHE_TAG_DEVTLB tags to remain after domain free and trigger use-after-free in cache_tag_flush_range during subsequent unmap operations.

Why it matters to the business

Kernel crashes and system instability in environments using VFIO with multiple VFs passed to user-space processes; low EPSS and no KEV status indicate limited immediate widespread risk but still requires prompt kernel updates given the 654 days since publication.

How an attack unfolds

An attacker configures multiple VFs from different PFs passed through to a single user-space process via vfio-pci, then performs DMA unmap operations that invoke intel_iommu_unmap_pages and cache_tag_flush_range after the domain has been freed, triggering the NULL pointer dereference.

How to fix it

Upgrade the Linux kernel to the fixed commit 9a0a72d3ed919ebe6491f527630998be053151d8 or later stable releases; apply the patch that moves cache_tag_unassign_domain() before iommu_disable_pci_caps().

How to confirm the fix worked

Verify the running kernel contains commit 9a0a72d3ed919ebe6491f527630998be053151d8, reproduce VFIO multi-VF unmap workloads, and confirm absence of the NULL pointer dereference in cache_tag_flush_range.

Typical attack path

1. Assign multiple VFs from separate PFs to a vfio-pci user-space process
2. Trigger domain teardown and unmap operations via vfio_iommu_type1_ioctl
3. Invoke cache_tag_flush_range after domain free to hit use-after-free

How to detect it

Search kernel logs for BUG: kernel NULL pointer dereference at address 0000000000000014 and the call trace containing cache_tag_flush_range, intel_iommu_tlb_sync, and vfio_remove_dma; inspect for repeated VFIO unmap activity preceding the crash.

• BUG: kernel NULL pointer dereference, address: 0000000000000014
• cache_tag_flush_range+0x9b/0x250
• intel_iommu_unmap_pages+0xfe/0x160
• vfio_remove_dma+0x2a/0xb0 [vfio_iommu_type1]

What your security team should do

• Apply the kernel fix immediately on systems using VFIO with multiple VFs
• Monitor for kernel oops involving cache_tag_flush_range and intel_iommu_unmap_pages
• Restrict VFIO device assignment to trusted processes until patched