CVE-2023-52455

A flaw was found in the Linux kernel. When the bootloader/firmware does not set up the framebuffers, the address and size are 0 in the "iommu-addresses" property. If the IOVA region is reserved with a 0 length, it corrupts the IOVA rbtree with an entry that has pfn_hi < pfn_lo. If the intent is to use the display driver in the kernel without the framebuffer, it causes the display IOMMU mappings to fail, as an entire valid IOVA space is reserved when the address and length are passed as 0. An ideal solution would be for the firmware to remove the "iommu-addresses" property and the corresponding "memory-region" if the display is not present. The kernel should be able to handle this by checking the size of the IOVA region and skipping the IOVA reservation if its size is 0. Also, add a warning if the firmware is requesting a 0-length IOVA region reservation.

This vulnerability is rated as Low severity because it depends on specific platform firmware configurations at boot time and does not permit privilege escalation or remote exploitation. The problem occurs when Open Firmware or Device Tree data defines zero-length framebuffer memory properties, which disrupts internal IOMMU range tracking for display hardware. Typical enterprise environments and systems utilizing standard UEFI boot paths or functional framebuffer initialization are not susceptible to this failure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

No mitigation is currently available for this vulnerability. Make sure to perform the updates as they become available.