CVE-2024-53232 iommu/s390: Implement blocking domain
A use-after-free vulnerability in the Linux kernel's s390 IOMMU driver allows a local attacker to cause a system crash during PCI device hot-unplugging.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-53232?
CVE-2024-53232 is a high-severity use after free vulnerability in Linux kernel, published on 27 Dec 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
iommu/s390: Implement blocking domain
This fixes a crash when surprise hot-unplugging a PCI device. This crash happens because during hot-unplug __iommu_group_set_domain_nofail() attaching the default domain fails when the platform no longer recognizes the device as it has already been removed and we end up with a NULL domain pointer and UAF. This is exactly the case referred to in the second comment in __iommu_device_set_domain() and just as stated there if we can instead attach the blocking domain the UAF is prevented as this can handle the already removed device. Implement the blocking domain to use this handling. With this change, the crash is fixed but we still hit a warning attempting to change DMA ownership on a blocked device.
Which versions are affected by CVE-2024-53232?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-53232?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2024-53232 being exploited?
There is no known exploitation of CVE-2024-53232 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-53232, DEBIAN-CVE-2024-53232, GHSA-c86m-78v8-4hvw, UBUNTU-CVE-2024-53232.