Linux swiotlb - info leak with DMA_FROM_DEVICE bounce buffers: MULTI-TENANT ISOLATION: The software IO TLB leaks

Impact

MULTI-TENANT ISOLATION: The software IO TLB leaks information through bounce buffers on DMA_FROM_DEVICE transfers - stale buffer contents are exposed rather than being overwritten by the device. swiotlb is the bounce-buffer layer that SEV and SEV-SNP guests are forced to use for all DMA, because a confidential guest cannot let a device write directly into encrypted memory. So this leak sits precisely on the path every confidential VM's I/O takes, and what leaks is whatever the previous user of that bounce buffer left behind.

Who can reach it

Local, through DMA operations that use bounce buffers - which is all device I/O in an SEV/SNP guest, and any DMA above the device's addressing limit on a normal host.

What to do

Fixed in the Linux kernel. Distro kernel update plus reboot; no firmware step. Prioritise on confidential-computing hosts and inside confidential guest images, since SEV guests route all I/O through swiotlb by design.

References