CVE-2024-41070

A possible use-after-free (UAF) exists in kvm_spapr_tce_attach_iommu_group() function which could allow an attacker to fdput() on the file descriptor closed by another thread. Although there are calls to rcu_read_lock() in order to prevent this, this is not sufficient because stt is used outside the locked regions.

A use-after-free flaw of moderate impact was found in the Linux kernel KVM implementation for PowerPC (Book3S HV) in kvm_spapr_tce_attach_iommu_group() (arch/powerpc/kvm/book3s_64_vio.c). The function looks up the SPAPR TCE table structure (stt) from a file descriptor but continues to use it after fdput() drops the file reference; another thread can then close the descriptor, which frees stt via kvm_spapr_tce_release() and release_spapr_tce_table(). The existing rcu_read_lock() calls do not prevent the race because stt is also used outside the locked regions. A local attacker able to issue KVM VFIO operations on a POWER system running the Book3S HV hypervisor could win this race and trigger a use-after-free in kernel memory, impacting confidentiality, integrity, and availability (upstream CVSS 3.1 score 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Red Hat Product Security rates this flaw as MODERATE, lower than the upstream HIGH rating, reflecting that exploitation requires local access and the vulnerable code path is specific to the KVM PowerPC Book3S HV hypervisor on POWER hardware. All Red Hat Enterprise Linux kernel and kernel-rt streams, as well as the hosted OpenShift (OSD and ARO) streams, are currently marked not affected; only Fedora is affected, where a fix is being pursued through the community kernel update process.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.