CVE-2023-52801

iommufd: Fix missing update of domains_itree after splitting iopt_area

Description

In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix missing update of domains_itree after splitting iopt_area In iopt_area_split(), if the original iopt_area has filled a domain and is linked to domains_itree, pages_nodes have to be properly reinserted. Otherwise the domains_itree becomes corrupted and we will UAF.

Category

9.1
CVSS
Severity: Critical
CVSS 3.1 •
EPSS 0.25%
Affected: Linux Linux
Affected: Linux Linux
Published at:
Updated at:

References

Link Tags
https://git.kernel.org/stable/c/836db2e7e4565d8218923b3552304a1637e2f28d patch
https://git.kernel.org/stable/c/fcb32111f01ddf3cbd04644cde1773428e31de6a patch
https://git.kernel.org/stable/c/e7250ab7ca4998fe026f2149805b03e09dc32498 patch

Frequently Asked Questions

What is the severity of CVE-2023-52801?
CVE-2023-52801 has been scored as a critical severity vulnerability.
How to fix CVE-2023-52801?
To fix CVE-2023-52801, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2023-52801 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2023-52801 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2023-52801?
CVE-2023-52801 affects Linux Linux, Linux Linux.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.