Описание
In the Linux kernel, the following vulnerability has been resolved:
iommu/amd: move wait_on_sem() out of spinlock
With iommu.strict=1, the existing completion wait path can cause soft
lockups under stressed environment, as wait_on_sem() busy-waits under the
spinlock with interrupts disabled.
Move the completion wait in iommu_completion_wait() out of the spinlock.
wait_on_sem() only polls the hardware-updated cmd_sem and does not require
iommu->lock, so holding the lock during the busy wait unnecessarily
increases contention and extends the time with interrupts disabled.
A flaw was found in the Linux kernel's IOMMU (Input/Output Memory Management Unit) AMD component. When the system operates under a stressed environment with iommu.strict=1 enabled, a busy-wait operation within the wait_on_sem() function can occur while holding a spinlock with interrupts disabled. This condition leads to increased contention and extended periods where the system cannot process interrupts, resulting in soft lockups. The primary consequence is a Denial of Service (DoS), making the system unresponsive.
Отчет
A low impact denial of service flaw was found in the AMD IOMMU driver of the Red Hat Enterprise Linux kernel. When a system runs with iommu.strict=1, the completion wait path in iommu_completion_wait() busy-waits in wait_on_sem() while holding a spinlock with interrupts disabled. In a stressed environment this extends the period during which interrupts are disabled and increases lock contention, which can result in soft lockups and an unresponsive system. The flaw is local in nature, requires the system to be configured with iommu.strict=1 and placed under stress to trigger, and impacts availability only; there is no impact to confidentiality or integrity, which is reflected in the low severity rating. The current Red Hat CVSS base score is 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), which differs from the 7.5 network attack vector score in the upstream CVE record because this kernel locking issue requires local access and is not remotely exploitable. Red Hat Enterprise Linux 6 and 7 Extended Lifecycle Support and Red Hat In-Vehicle OS 2.0 are not affected because the vulnerable code is not present in those streams. For the affected Red Hat Enterprise Linux 8, 9, and 10 kernel and kernel-rt streams, the fix has been deferred given the low severity and the specific preconditions required to trigger the issue (iommu.strict=1 and a stressed environment); the residual risk is limited to temporary soft lockups causing denial of service on systems running in that configuration.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
5.5 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: iommu/amd: move wait_on_sem() out of spinlock With iommu.strict=1, the existing completion wait path can cause soft lockups under stressed environment, as wait_on_sem() busy-waits under the spinlock with interrupts disabled. Move the completion wait in iommu_completion_wait() out of the spinlock. wait_on_sem() only polls the hardware-updated cmd_sem and does not require iommu->lock, so holding the lock during the busy wait unnecessarily increases contention and extends the time with interrupts disabled.
In the Linux kernel, the following vulnerability has been resolved: iommu/amd: move wait_on_sem() out of spinlock With iommu.strict=1, the existing completion wait path can cause soft lockups under stressed environment, as wait_on_sem() busy-waits under the spinlock with interrupts disabled. Move the completion wait in iommu_completion_wait() out of the spinlock. wait_on_sem() only polls the hardware-updated cmd_sem and does not require iommu->lock, so holding the lock during the busy wait unnecessarily increases contention and extends the time with interrupts disabled.
In the Linux kernel, the following vulnerability has been resolved: i ...
In the Linux kernel, the following vulnerability has been resolved: iommu/amd: move wait_on_sem() out of spinlock With iommu.strict=1, the existing completion wait path can cause soft lockups under stressed environment, as wait_on_sem() busy-waits under the spinlock with interrupts disabled. Move the completion wait in iommu_completion_wait() out of the spinlock. wait_on_sem() only polls the hardware-updated cmd_sem and does not require iommu->lock, so holding the lock during the busy wait unnecessarily increases contention and extends the time with interrupts disabled.
EPSS
5.5 Medium
CVSS3