CVE-2024-47719

A flaw was found in the Linux kernel's iommufd component. A local user could exploit this vulnerability by supplying specially crafted input values during an input/output virtual address (IOVA) allocation. This manipulation causes an overflow in the ALIGN() function, leading to the corruption of the selected memory area. The primary consequence of this flaw is a denial of service (DoS), which could make the system unavailable.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the iommufd kernel module from loading by blacklisting it. Create a file named /etc/modprobe.d/iommufd.conf with the following content:

blacklist iommufd

After creating the file, regenerate the initramfs and reboot the system for the changes to take effect. This may impact functionality that relies on the iommufd driver. If the system is not rebooted, the module may still be loaded if it was already in use. If the module is already loaded, it must be unloaded manually or the system must be rebooted for the mitigation to be effective. Always warn if there is a potential for reload and restarts.