Design/Logic Flaw

race in VT-d domain ID cleanup Xen domain IDs are up to 15 bits wide. VT-d hardware may allow for only less than 15 bits to hold a domain ID associating a physical device with a particular domain. Therefore internally Xen domain IDs are mapped to the smaller value range. The cleaning up of the...

IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues

ISSUE DESCRIPTION Certain PCI devices in a system might be assigned Reserved Memory Regions specified via Reserved Memory Region Reporting, "RMRR" for Intel VT-d or Unity Mapping ranges for AMD-Vi. These are typically used for platform tasks such as legacy USB emulation. Since the precise purpose...

race in VT-d domain ID cleanup

ISSUE DESCRIPTION Xen domain IDs are up to 15 bits wide. VT-d hardware may allow for only less than 15 bits to hold a domain ID associating a physical device with a particular domain. Therefore internally Xen domain IDs are mapped to the smaller value range. The cleaning up of the housekeeping...

CVE-2022-26357

CVE-2022-26357 is a race in Xen’s VT-d domain ID cleanup that can leak VT-d domain IDs and bypass housekeeping flushes. Reported across multiple Xen deployments (e.g., SUSE SLES/SLED, Gentoo advisories) with the issue rooted in mapping Xen domain IDs to a smaller value range and a race in the cle...

CVE-2022-26357

race in VT-d domain ID cleanup Xen domain IDs are up to 15 bits wide. VT-d hardware may allow for only less than 15 bits to hold a domain ID associating a physical device with a particular domain. Therefore internally Xen domain IDs are mapped to the smaller value range. The cleaning up of the...

CVE-2022-26361

IOMMU: RMRR VT-d and unity map AMD-Vi handling issues This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. Certain PCI devices in a system might be assigned Reserved Memory Regions specified via Reserved Memory Region...

CVE-2022-26360

CVE-2022-26360 affects Xen with IOMMU: RMRR (VT-d) and Unity Mapping (AMD-Vi). The issue arises when mappings for Reserved Memory Regions or Unity Mapping ranges remain accessible after a device activation, allowing subsequent DMA/interrupts to cause IOMMU faults or memory corruption. The connect...

CVE-2022-26358

CVE-2022-26358 affects the Xen hypervisor (IOMMU: RMRR VT-d and Unity Mapping for AMD-Vi). Issues arise when a device with Reserved Memory Regions remains accessible, potentially causing DMA/interrupts to trigger IOMMU faults or memory corruption. Connected advisories document multiple vendors (S...

CVE-2022-26359

CVE-2022-26359 is a Xen hypervisor issue related to IOMMU handling of RMRR (VT-d) and Unity Mapping (AMD-Vi). Public sources describe that when a device with such a region is active, mappings must remain accessible, and violations can lead to unpredictable DMA/interrupt behavior and memory corrup...

CVE-2022-26361

CVE-2022-26361 affects the Xen hypervisor via IOMMU handling (RMRR VT-d and Unity Mapping AMD-Vi). The issue arises when mappings for Reserved Memory Regions or Unity Mapping ranges must remain accessible and are violated, enabling unpredictable DMA/interrupt behavior and potential memory corrupt...

CVE-2022-26359

IOMMU: RMRR VT-d and unity map AMD-Vi handling issues This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. Certain PCI devices in a system might be assigned Reserved Memory Regions specified via Reserved Memory Region...

CVE-2022-26358

IOMMU: RMRR VT-d and unity map AMD-Vi handling issues This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. Certain PCI devices in a system might be assigned Reserved Memory Regions specified via Reserved Memory Region...

CVE-2022-26357

race in VT-d domain ID cleanup Xen domain IDs are up to 15 bits wide. VT-d hardware may allow for only less than 15 bits to hold a domain ID associating a physical device with a particular domain. Therefore internally Xen domain IDs are mapped to the smaller value range. The cleaning up of the...

CVE-2022-26361

IOMMU: RMRR VT-d and unity map AMD-Vi handling issues This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. Certain PCI devices in a system might be assigned Reserved Memory Regions specified via Reserved Memory Region...

CVE-2022-26359

IOMMU: RMRR VT-d and unity map AMD-Vi handling issues This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. Certain PCI devices in a system might be assigned Reserved Memory Regions specified via Reserved Memory Region...

CVE-2022-26360

IOMMU: RMRR VT-d and unity map AMD-Vi handling issues This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. Certain PCI devices in a system might be assigned Reserved Memory Regions specified via Reserved Memory Region...

AZL-41790 CVE-2022-28391 affecting package busybox for versions less than 1.36.1-3

BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors...

AZL-9311 CVE-2022-28391 affecting package busybox for versions less than 1.35.0-2

BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors...

GSD-2022-1000780 iommu/vt-d: Fix double list_add when enabling VMD in scalable mode

iommu/vt-d: Fix double listadd when enabling VMD in scalable mode This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.27 by commit...

GSD-2022-1000711 iommu/vt-d: Fix double list_add when enabling VMD in scalable mode

iommu/vt-d: Fix double listadd when enabling VMD in scalable mode This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.16.13 by commit...