CVE-2022-48890

scsi: storvsc: Fix swiotlb bounce buffer leak in confidential VM

published August 21, 2024

CVSS
—
EPSS
0%
Percentile
10.4
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

scsi: storvsc: Fix swiotlb bounce buffer leak in confidential VM

storvsc_queuecommand() maps the scatter/gather list using scsi_dma_map(),

which in a confidential VM allocates swiotlb bounce buffers. If the I/O

submission fails in storvsc_do_io(), the I/O is typically retried by higher

level code, but the bounce buffer memory is never freed. The mostly like

cause of I/O submission failure is a full VMBus channel ring buffer, which

is not uncommon under high I/O loads. Eventually enough bounce buffer

memory leaks that the confidential VM can't do any I/O. The same problem

can arise in a non-confidential VM with kernel boot parameter

swiotlb=force.

Fix this by doing scsi_dma_unmap() in the case of an I/O submission

error, which frees the bounce buffer memory.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00208 · 10.4th percentile
Published
2024-08-21T06:10Z
EPSS history
Timeline
  • 21 AUG 06:10Z
    scsi: storvsc: Fix swiotlb bounce buffer leak in confidential VM
    cvelistv5