cve/2024/CVE-2024-41070.md

### [CVE-2024-41070](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-41070)
![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=121f80ba68f1a5779a36d7b3247206e60e0a7418%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=4.12%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue)

### Description

In the Linux kernel, the following vulnerability has been resolved:KVM: PPC: Book3S HV: Prevent UAF in kvm_spapr_tce_attach_iommu_group()Al reported a possible use-after-free (UAF) in kvm_spapr_tce_attach_iommu_group().It looks up `stt` from tablefd, but then continues to use it after doingfdput() on the returned fd. After the fdput() the tablefd is free to beclosed by another thread. The close calls kvm_spapr_tce_release() andthen release_spapr_tce_table() (via call_rcu()) which frees `stt`.Although there are calls to rcu_read_lock() inkvm_spapr_tce_attach_iommu_group() they are not sufficient to preventthe UAF, because `stt` is used outside the locked regions.With an artifcial delay after the fdput() and a userspace program whichtriggers the race, KASAN detects the UAF:  BUG: KASAN: slab-use-after-free in kvm_spapr_tce_attach_iommu_group+0x298/0x720 [kvm]  Read of size 4 at addr c000200027552c30 by task kvm-vfio/2505  CPU: 54 PID: 2505 Comm: kvm-vfio Not tainted 6.10.0-rc3-next-20240612-dirty #1  Hardware name: 8335-GTH POWER9 0x4e1202 opal:skiboot-v6.5.3-35-g1851b2a06 PowerNV  Call Trace:    dump_stack_lvl+0xb4/0x108 (unreliable)    print_report+0x2b4/0x6ec    kasan_report+0x118/0x2b0    __asan_load4+0xb8/0xd0    kvm_spapr_tce_attach_iommu_group+0x298/0x720 [kvm]    kvm_vfio_set_attr+0x524/0xac0 [kvm]    kvm_device_ioctl+0x144/0x240 [kvm]    sys_ioctl+0x62c/0x1810    system_call_exception+0x190/0x440    system_call_vectored_common+0x15c/0x2ec  ...  Freed by task 0:   ...   kfree+0xec/0x3e0   release_spapr_tce_table+0xd4/0x11c [kvm]   rcu_core+0x568/0x16a0   handle_softirqs+0x23c/0x920   do_softirq_own_stack+0x6c/0x90   do_softirq_own_stack+0x58/0x90   __irq_exit_rcu+0x218/0x2d0   irq_exit+0x30/0x80   arch_local_irq_restore+0x128/0x230   arch_local_irq_enable+0x1c/0x30   cpuidle_enter_state+0x134/0x5cc   cpuidle_enter+0x6c/0xb0   call_cpuidle+0x7c/0x100   do_idle+0x394/0x410   cpu_startup_entry+0x60/0x70   start_secondary+0x3fc/0x410   start_secondary_prolog+0x10/0x14Fix it by delaying the fdput() until `stt` is no longer in use, whichis effectively the entire function. To keep the patch minimal add a callto fdput() at each of the existing return paths. Future work can convertthe function to goto or __cleanup style cleanup.With the fix in place the test case no longer triggers the UAF.

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/fkie-cad/nvd-json-data-feeds