Linux kernel (drivers/iommu/iommufd): An error path releases the iommufd fault object and the iommufd context twice

CVSS 7.8CVE-2024-56624Kernel, userspace & hypervisorcurated

Impact

An error path releases the iommufd fault object and the iommufd context twice, driving their refcounts through zero. The object that owns a tenant's entire IOMMU address space gets freed while still referenced, giving a use-after-free on host kernel memory reachable from a tenant ioctl.

Who can reach it

A process holding /dev/iommu - the VMM (qemu) for a passthrough VM, or any container that was given the iommufd node. The tenant calls the fault-queue allocation ioctl and forces the tail of the handler to fail (e.g. by supplying a bad output pointer), which runs the double-release path. Conditional on iommufd being in use rather than the legacy vfio type1 container; iommufd is the default path for nested translation and I/O page-fault handling.

What to do

The record lists no fixed release; boot a kernel carrying the stable fix commits below. Interim controls: do not expose /dev/iommu to tenant containers, and keep passthrough on the legacy vfio type1 container where the workload allows it.

References

https://git.kernel.org/stable/c/2b3f30c8edbf9a122ce01f13f0f41fbca5f1d41d https://git.kernel.org/stable/c/af7f4780514f850322b2959032ecaa96e4b26472 https://nvd.nist.gov/vuln/detail/CVE-2024-56624

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.