GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2023-52910 (GCVE-0-2023-52910)

Vulnerability from cvelistv5 – Published: 2024-08-21 06:10 – Updated: 2026-08-05 09:11
VLAI
Title
iommu/iova: Fix alloc iova overflows issue
Summary
In the Linux kernel, the following vulnerability has been resolved: iommu/iova: Fix alloc iova overflows issue In __alloc_and_insert_iova_range, there is an issue that retry_pfn overflows. The value of iovad->anchor.pfn_hi is ~0UL, then when iovad->cached_node is iovad->anchor, curr_iova->pfn_hi + 1 will overflow. As a result, if the retry logic is executed, low_pfn is updated to 0, and then new_pfn < low_pfn returns false to make the allocation successful. This issue occurs in the following two situations: 1. The first iova size exceeds the domain size. When initializing iova domain, iovad->cached_node is assigned as iovad->anchor. For example, the iova domain size is 10M, start_pfn is 0x1_F000_0000, and the iova size allocated for the first time is 11M. The following is the log information, new->pfn_lo is smaller than iovad->cached_node. Example log as follows: [ 223.798112][T1705487] sh: [name:iova&]__alloc_and_insert_iova_range start_pfn:0x1f0000,retry_pfn:0x0,size:0xb00,limit_pfn:0x1f0a00 [ 223.799590][T1705487] sh: [name:iova&]__alloc_and_insert_iova_range success start_pfn:0x1f0000,new->pfn_lo:0x1efe00,new->pfn_hi:0x1f08ff 2. The node with the largest iova->pfn_lo value in the iova domain is deleted, iovad->cached_node will be updated to iovad->anchor, and then the alloc iova size exceeds the maximum iova size that can be allocated in the domain. After judging that retry_pfn is less than limit_pfn, call retry_pfn+1 to fix the overflow issue.
Severity
8.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 15:34 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 4e89dce725213d3d0b0475211b500eda4ef4bf2f , < c929a230c84441e400c32e7b7b4ab763711fb63e (git)
Affected: 4e89dce725213d3d0b0475211b500eda4ef4bf2f , < 61cbf790e7329ed78877560be7136f0b911bba7f (git)
Affected: 4e89dce725213d3d0b0475211b500eda4ef4bf2f , < dcdb3ba7e2a8caae7bfefd603bc22fd0ce9a389c (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.11
Unaffected: 0 , < 5.11 (semver)
Unaffected: 5.15.89 , ≤ 5.15.* (semver)
Unaffected: 6.1.7 , ≤ 6.1.* (semver)
Unaffected: 6.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-52910",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:34:52.014408Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T17:33:03.507Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/iova.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c929a230c84441e400c32e7b7b4ab763711fb63e",
              "status": "affected",
              "version": "4e89dce725213d3d0b0475211b500eda4ef4bf2f",
              "versionType": "git"
            },
            {
              "lessThan": "61cbf790e7329ed78877560be7136f0b911bba7f",
              "status": "affected",
              "version": "4e89dce725213d3d0b0475211b500eda4ef4bf2f",
              "versionType": "git"
            },
            {
              "lessThan": "dcdb3ba7e2a8caae7bfefd603bc22fd0ce9a389c",
              "status": "affected",
              "version": "4e89dce725213d3d0b0475211b500eda4ef4bf2f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/iova.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.11"
            },
            {
              "lessThan": "5.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.89",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.89",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.7",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/iova: Fix alloc iova overflows issue\n\nIn __alloc_and_insert_iova_range, there is an issue that retry_pfn\noverflows. The value of iovad-\u003eanchor.pfn_hi is ~0UL, then when\niovad-\u003ecached_node is iovad-\u003eanchor, curr_iova-\u003epfn_hi + 1 will\noverflow. As a result, if the retry logic is executed, low_pfn is\nupdated to 0, and then new_pfn \u003c low_pfn returns false to make the\nallocation successful.\n\nThis issue occurs in the following two situations:\n1. The first iova size exceeds the domain size. When initializing\niova domain, iovad-\u003ecached_node is assigned as iovad-\u003eanchor. For\nexample, the iova domain size is 10M, start_pfn is 0x1_F000_0000,\nand the iova size allocated for the first time is 11M. The\nfollowing is the log information, new-\u003epfn_lo is smaller than\niovad-\u003ecached_node.\n\nExample log as follows:\n[  223.798112][T1705487] sh: [name:iova\u0026]__alloc_and_insert_iova_range\nstart_pfn:0x1f0000,retry_pfn:0x0,size:0xb00,limit_pfn:0x1f0a00\n[  223.799590][T1705487] sh: [name:iova\u0026]__alloc_and_insert_iova_range\nsuccess start_pfn:0x1f0000,new-\u003epfn_lo:0x1efe00,new-\u003epfn_hi:0x1f08ff\n\n2. The node with the largest iova-\u003epfn_lo value in the iova domain\nis deleted, iovad-\u003ecached_node will be updated to iovad-\u003eanchor,\nand then the alloc iova size exceeds the maximum iova size that can\nbe allocated in the domain.\n\nAfter judging that retry_pfn is less than limit_pfn, call retry_pfn+1\nto fix the overflow issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is in the IOVA allocator used by dma-iommu (and related drivers); it is reached when a local process causes a DMA mapping larger than the IOVA domain via device interfaces such as V4L2/DRM/camera on MediaTek platforms, not via network packet processing.\nAC:L - Triggering is deterministic once an allocation exceeds the domain size while cached_node is the anchor (empty domain or after freeing the top IOVA): the pfn_hi+1 wrap to 0 reliably makes the oversized alloc succeed, and the attacker controls buffer size and alloc/free sequencing.\nPR:L - On the highest-impact deployments (MediaTek Android phones with small per-device IOVA regions), unprivileged apps can request large DMA-mapped media/GPU buffers through standard device nodes without real root or init-namespace capabilities.\nUI:N - The attacking process alone issues the buffer allocations/DMA maps that hit the overflow path; no separate victim action is required.\nS:C - On MediaTek IOMMU, multiple IOVA regions share one page table and rely on software apertures for isolation; allocating below start_pfn installs translations into another device region\u0027s IOVA space, breaking the IOMMU/DMA isolation boundary between device groups.\nC:H - Cross-region PTE installation in the shared page table can redirect another device\u0027s DMA reads onto attacker-controlled buffers or expose other devices\u0027 memory via confused DMA mappings, yielding a high-impact disclosure primitive.\nI:H - The same out-of-aperture mapping can overwrite or collide with another master\u0027s IOVA translations in the shared pgtable, so device DMA writes land on the wrong physical pages \u2014 a high-integrity memory corruption primitive across the DMA isolation boundary.\nA:H - Conflicting IOVA translations and DMA to addresses outside the intended aperture reliably produce IOMMU faults, WARN_ONs in the page-table code, and kernel oopses/panics."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:11:57.069Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c929a230c84441e400c32e7b7b4ab763711fb63e"
        },
        {
          "url": "https://git.kernel.org/stable/c/61cbf790e7329ed78877560be7136f0b911bba7f"
        },
        {
          "url": "https://git.kernel.org/stable/c/dcdb3ba7e2a8caae7bfefd603bc22fd0ce9a389c"
        }
      ],
      "title": "iommu/iova: Fix alloc iova overflows issue",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-52910",
    "datePublished": "2024-08-21T06:10:51.337Z",
    "dateReserved": "2024-08-21T06:07:11.015Z",
    "dateUpdated": "2026-08-05T09:11:57.069Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-52910",
      "date": "2026-09-19",
      "epss": "0.00245",
      "percentile": "0.1605"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "E706841F-E788-4316-9B05-DA8EB60CE6B3",
                  "versionEndExcluding": "5.15.89",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "9275C81F-AE96-4CDB-AD20-7DBD36E5D909",
                  "versionEndExcluding": "6.1.7",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc1:*:*:*:*:*:*",
                  "matchCriteriaId": "FF501633-2F44-4913-A8EE-B021929F49F6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc2:*:*:*:*:*:*",
                  "matchCriteriaId": "2BDA597B-CAC1-4DF0-86F0-42E142C654E9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc3:*:*:*:*:*:*",
                  "matchCriteriaId": "725C78C9-12CE-406F-ABE8-0813A01D66E8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/iova: Fix alloc iova overflows issue\n\nIn __alloc_and_insert_iova_range, there is an issue that retry_pfn\noverflows. The value of iovad-\u003eanchor.pfn_hi is ~0UL, then when\niovad-\u003ecached_node is iovad-\u003eanchor, curr_iova-\u003epfn_hi + 1 will\noverflow. As a result, if the retry logic is executed, low_pfn is\nupdated to 0, and then new_pfn \u003c low_pfn returns false to make the\nallocation successful.\n\nThis issue occurs in the following two situations:\n1. The first iova size exceeds the domain size. When initializing\niova domain, iovad-\u003ecached_node is assigned as iovad-\u003eanchor. For\nexample, the iova domain size is 10M, start_pfn is 0x1_F000_0000,\nand the iova size allocated for the first time is 11M. The\nfollowing is the log information, new-\u003epfn_lo is smaller than\niovad-\u003ecached_node.\n\nExample log as follows:\n[  223.798112][T1705487] sh: [name:iova\u0026]__alloc_and_insert_iova_range\nstart_pfn:0x1f0000,retry_pfn:0x0,size:0xb00,limit_pfn:0x1f0a00\n[  223.799590][T1705487] sh: [name:iova\u0026]__alloc_and_insert_iova_range\nsuccess start_pfn:0x1f0000,new-\u003epfn_lo:0x1efe00,new-\u003epfn_hi:0x1f08ff\n\n2. The node with the largest iova-\u003epfn_lo value in the iova domain\nis deleted, iovad-\u003ecached_node will be updated to iovad-\u003eanchor,\nand then the alloc iova size exceeds the maximum iova size that can\nbe allocated in the domain.\n\nAfter judging that retry_pfn is less than limit_pfn, call retry_pfn+1\nto fix the overflow issue."
        },
        {
          "lang": "es",
          "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: iommu/iova: soluciona el problema de desbordamiento de alloc iova. En __alloc_and_insert_iova_range, hay un problema que retry_pfn se desborda. El valor de iovad-\u0026gt;anchor.pfn_hi es ~0UL, luego, cuando iovad-\u0026gt;cached_node es iovad-\u0026gt;anchor, curr_iova-\u0026gt;pfn_hi + 1 se desbordar\u00e1. Como resultado, si se ejecuta la l\u00f3gica de reintento, low_pfn se actualiza a 0 y luego new_pfn \u0026lt; low_pfn devuelve falso para que la asignaci\u00f3n sea exitosa. Este problema ocurre en las dos situaciones siguientes: 1. El tama\u00f1o del primer iova excede el tama\u00f1o del dominio. Al inicializar el dominio iova, iovad-\u0026gt;cached_node se asigna como iovad-\u0026gt;anchor. Por ejemplo, el tama\u00f1o del dominio iova es 10 M, start_pfn es 0x1_F000_0000 y el tama\u00f1o de iova asignado por primera vez es 11 M. La siguiente es la informaci\u00f3n de registro, new-\u0026gt;pfn_lo es m\u00e1s peque\u00f1o que iovad-\u0026gt;cached_node. Registro de ejemplo como sigue: [ 223.798112][T1705487] sh: [name:iova\u0026amp;]__alloc_and_insert_iova_range start_pfn:0x1f0000,retry_pfn:0x0,size:0xb00,limit_pfn:0x1f0a00 [ 223.799590][T1705487] [nombre:iova\u0026amp;]__alloc_and_insert_iova_range \u00e9xito start_pfn :0x1f0000,new-\u0026gt;pfn_lo:0x1efe00,new-\u0026gt;pfn_hi:0x1f08ff 2. El nodo con el valor iova-\u0026gt;pfn_lo m\u00e1s grande en el dominio iova se elimina, iovad-\u0026gt;cached_node se actualizar\u00e1 a iovad-\u0026gt;anchor y luego el tama\u00f1o de alloc iova excede el tama\u00f1o m\u00e1ximo de iova que se puede asignar en el dominio. Despu\u00e9s de juzgar que retry_pfn es menor que limit_pfn, llame a retry_pfn+1 para solucionar el problema de desbordamiento."
        }
      ],
      "id": "CVE-2023-52910",
      "lastModified": "2024-09-12T14:47:08.540",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            },
            "exploitabilityScore": 1.8,
            "impactScore": 3.6,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2024-08-21T07:15:06.910",
      "references": [
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/61cbf790e7329ed78877560be7136f0b911bba7f"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/c929a230c84441e400c32e7b7b4ab763711fb63e"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/dcdb3ba7e2a8caae7bfefd603bc22fd0ce9a389c"
        }
      ],
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "NVD-CWE-noinfo"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/iommu/iova.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "c929a230c84441e400c32e7b7b4ab763711fb63e",
                    "status": "affected",
                    "version": "4e89dce725213d3d0b0475211b500eda4ef4bf2f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "61cbf790e7329ed78877560be7136f0b911bba7f",
                    "status": "affected",
                    "version": "4e89dce725213d3d0b0475211b500eda4ef4bf2f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "dcdb3ba7e2a8caae7bfefd603bc22fd0ce9a389c",
                    "status": "affected",
                    "version": "4e89dce725213d3d0b0475211b500eda4ef4bf2f",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/iommu/iova.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.11"
                  },
                  {
                    "lessThan": "5.11",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.89",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.7",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E706841F-E788-4316-9B05-DA8EB60CE6B3",
                    "versionEndExcluding": "5.15.89",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "9275C81F-AE96-4CDB-AD20-7DBD36E5D909",
                    "versionEndExcluding": "6.1.7",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "FF501633-2F44-4913-A8EE-B021929F49F6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "2BDA597B-CAC1-4DF0-86F0-42E142C654E9",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "725C78C9-12CE-406F-ABE8-0813A01D66E8",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/iova: Fix alloc iova overflows issue\n\nIn __alloc_and_insert_iova_range, there is an issue that retry_pfn\noverflows. The value of iovad-\u003eanchor.pfn_hi is ~0UL, then when\niovad-\u003ecached_node is iovad-\u003eanchor, curr_iova-\u003epfn_hi + 1 will\noverflow. As a result, if the retry logic is executed, low_pfn is\nupdated to 0, and then new_pfn \u003c low_pfn returns false to make the\nallocation successful.\n\nThis issue occurs in the following two situations:\n1. The first iova size exceeds the domain size. When initializing\niova domain, iovad-\u003ecached_node is assigned as iovad-\u003eanchor. For\nexample, the iova domain size is 10M, start_pfn is 0x1_F000_0000,\nand the iova size allocated for the first time is 11M. The\nfollowing is the log information, new-\u003epfn_lo is smaller than\niovad-\u003ecached_node.\n\nExample log as follows:\n[  223.798112][T1705487] sh: [name:iova\u0026]__alloc_and_insert_iova_range\nstart_pfn:0x1f0000,retry_pfn:0x0,size:0xb00,limit_pfn:0x1f0a00\n[  223.799590][T1705487] sh: [name:iova\u0026]__alloc_and_insert_iova_range\nsuccess start_pfn:0x1f0000,new-\u003epfn_lo:0x1efe00,new-\u003epfn_hi:0x1f08ff\n\n2. The node with the largest iova-\u003epfn_lo value in the iova domain\nis deleted, iovad-\u003ecached_node will be updated to iovad-\u003eanchor,\nand then the alloc iova size exceeds the maximum iova size that can\nbe allocated in the domain.\n\nAfter judging that retry_pfn is less than limit_pfn, call retry_pfn+1\nto fix the overflow issue."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: iommu/iova: soluciona el problema de desbordamiento de alloc iova. En __alloc_and_insert_iova_range, hay un problema que retry_pfn se desborda. El valor de iovad-\u0026gt;anchor.pfn_hi es ~0UL, luego, cuando iovad-\u0026gt;cached_node es iovad-\u0026gt;anchor, curr_iova-\u0026gt;pfn_hi + 1 se desbordar\u00e1. Como resultado, si se ejecuta la l\u00f3gica de reintento, low_pfn se actualiza a 0 y luego new_pfn \u0026lt; low_pfn devuelve falso para que la asignaci\u00f3n sea exitosa. Este problema ocurre en las dos situaciones siguientes: 1. El tama\u00f1o del primer iova excede el tama\u00f1o del dominio. Al inicializar el dominio iova, iovad-\u0026gt;cached_node se asigna como iovad-\u0026gt;anchor. Por ejemplo, el tama\u00f1o del dominio iova es 10 M, start_pfn es 0x1_F000_0000 y el tama\u00f1o de iova asignado por primera vez es 11 M. La siguiente es la informaci\u00f3n de registro, new-\u0026gt;pfn_lo es m\u00e1s peque\u00f1o que iovad-\u0026gt;cached_node. Registro de ejemplo como sigue: [ 223.798112][T1705487] sh: [name:iova\u0026amp;]__alloc_and_insert_iova_range start_pfn:0x1f0000,retry_pfn:0x0,size:0xb00,limit_pfn:0x1f0a00 [ 223.799590][T1705487] [nombre:iova\u0026amp;]__alloc_and_insert_iova_range \u00e9xito start_pfn :0x1f0000,new-\u0026gt;pfn_lo:0x1efe00,new-\u0026gt;pfn_hi:0x1f08ff 2. El nodo con el valor iova-\u0026gt;pfn_lo m\u00e1s grande en el dominio iova se elimina, iovad-\u0026gt;cached_node se actualizar\u00e1 a iovad-\u0026gt;anchor y luego el tama\u00f1o de alloc iova excede el tama\u00f1o m\u00e1ximo de iova que se puede asignar en el dominio. Despu\u00e9s de juzgar que retry_pfn es menor que limit_pfn, llame a retry_pfn+1 para solucionar el problema de desbordamiento."
          }
        ],
        "id": "CVE-2023-52910",
        "lastModified": "2026-08-04T10:18:48.597",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.0,
              "impactScore": 6.0,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2023-52910",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:34:52.014408Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-08-21T07:15:06.910",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/61cbf790e7329ed78877560be7136f0b911bba7f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/c929a230c84441e400c32e7b7b4ab763711fb63e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/dcdb3ba7e2a8caae7bfefd603bc22fd0ce9a389c"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:23:25+00:00",
      "cve": "CVE-2023-52910",
      "id": "CVE-2023-52910",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: iommu/iova: Fix alloc iova overflows issue",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-52910.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-11T02:24:07Z",
      "cve": "CVE-2023-52910",
      "id": "CVE-2023-52910",
      "initial_release_date": "2024-09-08T03:02:38Z",
      "product_status:known_affected": "340",
      "product_status:known_not_affected": "250",
      "product_status:recommended": "288",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-52910",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-52910.json",
      "version": "41"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2023-52910",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-09-10T15:34:52.014408Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-09-11T12:42:12.983Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "drivers/iommu/iova.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "c929a230c84441e400c32e7b7b4ab763711fb63e",
                  "status": "affected",
                  "version": "4e89dce725213d3d0b0475211b500eda4ef4bf2f",
                  "versionType": "git"
                },
                {
                  "lessThan": "61cbf790e7329ed78877560be7136f0b911bba7f",
                  "status": "affected",
                  "version": "4e89dce725213d3d0b0475211b500eda4ef4bf2f",
                  "versionType": "git"
                },
                {
                  "lessThan": "dcdb3ba7e2a8caae7bfefd603bc22fd0ce9a389c",
                  "status": "affected",
                  "version": "4e89dce725213d3d0b0475211b500eda4ef4bf2f",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "drivers/iommu/iova.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "5.11"
                },
                {
                  "lessThan": "5.11",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.15.*",
                  "status": "unaffected",
                  "version": "5.15.89",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.1.*",
                  "status": "unaffected",
                  "version": "6.1.7",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.2",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.15.89",
                      "versionStartIncluding": "5.11",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.1.7",
                      "versionStartIncluding": "5.11",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.2",
                      "versionStartIncluding": "5.11",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/iova: Fix alloc iova overflows issue\n\nIn __alloc_and_insert_iova_range, there is an issue that retry_pfn\noverflows. The value of iovad-\u003eanchor.pfn_hi is ~0UL, then when\niovad-\u003ecached_node is iovad-\u003eanchor, curr_iova-\u003epfn_hi + 1 will\noverflow. As a result, if the retry logic is executed, low_pfn is\nupdated to 0, and then new_pfn \u003c low_pfn returns false to make the\nallocation successful.\n\nThis issue occurs in the following two situations:\n1. The first iova size exceeds the domain size. When initializing\niova domain, iovad-\u003ecached_node is assigned as iovad-\u003eanchor. For\nexample, the iova domain size is 10M, start_pfn is 0x1_F000_0000,\nand the iova size allocated for the first time is 11M. The\nfollowing is the log information, new-\u003epfn_lo is smaller than\niovad-\u003ecached_node.\n\nExample log as follows:\n[  223.798112][T1705487] sh: [name:iova\u0026]__alloc_and_insert_iova_range\nstart_pfn:0x1f0000,retry_pfn:0x0,size:0xb00,limit_pfn:0x1f0a00\n[  223.799590][T1705487] sh: [name:iova\u0026]__alloc_and_insert_iova_range\nsuccess start_pfn:0x1f0000,new-\u003epfn_lo:0x1efe00,new-\u003epfn_hi:0x1f08ff\n\n2. The node with the largest iova-\u003epfn_lo value in the iova domain\nis deleted, iovad-\u003ecached_node will be updated to iovad-\u003eanchor,\nand then the alloc iova size exceeds the maximum iova size that can\nbe allocated in the domain.\n\nAfter judging that retry_pfn is less than limit_pfn, call retry_pfn+1\nto fix the overflow issue."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:L - The bug is in the IOVA allocator used by dma-iommu (and related drivers); it is reached when a local process causes a DMA mapping larger than the IOVA domain via device interfaces such as V4L2/DRM/camera on MediaTek platforms, not via network packet processing.\nAC:L - Triggering is deterministic once an allocation exceeds the domain size while cached_node is the anchor (empty domain or after freeing the top IOVA): the pfn_hi+1 wrap to 0 reliably makes the oversized alloc succeed, and the attacker controls buffer size and alloc/free sequencing.\nPR:L - On the highest-impact deployments (MediaTek Android phones with small per-device IOVA regions), unprivileged apps can request large DMA-mapped media/GPU buffers through standard device nodes without real root or init-namespace capabilities.\nUI:N - The attacking process alone issues the buffer allocations/DMA maps that hit the overflow path; no separate victim action is required.\nS:C - On MediaTek IOMMU, multiple IOVA regions share one page table and rely on software apertures for isolation; allocating below start_pfn installs translations into another device region\u0027s IOVA space, breaking the IOMMU/DMA isolation boundary between device groups.\nC:H - Cross-region PTE installation in the shared page table can redirect another device\u0027s DMA reads onto attacker-controlled buffers or expose other devices\u0027 memory via confused DMA mappings, yielding a high-impact disclosure primitive.\nI:H - The same out-of-aperture mapping can overwrite or collide with another master\u0027s IOVA translations in the shared pgtable, so device DMA writes land on the wrong physical pages \u2014 a high-integrity memory corruption primitive across the DMA isolation boundary.\nA:H - Conflicting IOVA translations and DMA to addresses outside the intended aperture reliably produce IOMMU faults, WARN_ONs in the page-table code, and kernel oopses/panics."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T09:11:57.069Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/c929a230c84441e400c32e7b7b4ab763711fb63e"
            },
            {
              "url": "https://git.kernel.org/stable/c/61cbf790e7329ed78877560be7136f0b911bba7f"
            },
            {
              "url": "https://git.kernel.org/stable/c/dcdb3ba7e2a8caae7bfefd603bc22fd0ce9a389c"
            }
          ],
          "title": "iommu/iova: Fix alloc iova overflows issue",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2023-52910",
        "datePublished": "2024-08-21T06:10:51.337Z",
        "dateReserved": "2024-08-21T06:07:11.015Z",
        "dateUpdated": "2026-08-05T09:11:57.069Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.