CVE-2024-56624CWE-401

CVE-2024-56624

High · published December 27, 2024

CVSS v3.1
7.8
EPSS
0%
Percentile
7.9
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

iommufd: Fix out_fput in iommufd_fault_alloc()

As fput() calls the file->f_op->release op, where fault obj and ictx are

getting released, there is no need to release these two after fput() one

more time, which would result in imbalanced refcounts:

refcount_t: decrement hit 0; leaking memory.

WARNING: CPU: 48 PID: 2369 at lib/refcount.c:31 refcount_warn_saturate+0x60/0x230

Call trace:

refcount_warn_saturate+0x60/0x230 (P)

refcount_warn_saturate+0x60/0x230 (L)

iommufd_fault_fops_release+0x9c/0xe0 [iommufd]

...

VFS: Close: file count is 0 (f_op=iommufd_fops [iommufd])

WARNING: CPU: 48 PID: 2369 at fs/open.c:1507 filp_flush+0x3c/0xf0

Call trace:

filp_flush+0x3c/0xf0 (P)

filp_flush+0x3c/0xf0 (L)

__arm64_sys_close+0x34/0x98

...

imbalanced put on file reference count

WARNING: CPU: 48 PID: 2369 at fs/file.c:74 __file_ref_put+0x100/0x138

Call trace:

__file_ref_put+0x100/0x138 (P)

__file_ref_put+0x100/0x138 (L)

__fput_sync+0x4c/0xd0

Drop those two lines to fix the warnings above.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00188 · 7.9th percentile
Weakness
CWE-401 · Missing Release of Memory after Effective Lifetime
Published
2024-12-27T20:15Z
Affected products (2)
ProductVersionsFixed in
linux/linux_kernelall versions—
linux/linux_kernel≥ 6.11, < 6.12.56.12.5
References (2)
EPSS history
Timeline
  • 27 DEC 14:51Z
    iommufd: Fix out_fput in iommufd_fault_alloc()
    cvelistv5