CVE-2024-41070: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-41070 affects the Linux kernel and involves a use-after-free (UAF) vulnerability in the kvm_spapr_tce_attach_iommu_group() function. The vulnerability was discovered in July 2024 and affects multiple versions of the Linux kernel up to versions 5.4.281, 5.10.223, 5.15.164, 6.1.101, and 6.9.11 (NVD).

The vulnerability occurs when the function looks up stt from tablefd but continues to use it after performing fdput() on the returned fd. After fdput(), the tablefd becomes free to be closed by another thread, which calls kvm_spapr_tce_release() and then release_spapr_tce_table() via call_rcu(), leading to the freeing of stt. Although rcu_read_lock() calls exist in the function, they are insufficient to prevent the UAF because stt is used outside the locked regions. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

The vulnerability could allow a local attacker to potentially cause a denial of service through system crashes or possibly execute arbitrary code. The issue affects the KVM virtualization subsystem on PowerPC systems, specifically in the SPAPR TCE (Translation Control Entry) handling code (Kernel Patch).

The vulnerability can be triggered by a userspace program that exploits the race condition. A proof-of-concept exists that can trigger the UAF condition, which has been detected by KASAN (Kernel Address Sanitizer) during testing (Kernel Patch).

The vulnerability has been fixed by modifying the code to delay the fdput() operation until stt is no longer in use, effectively extending it to the entire function. The fix adds fdput() calls at each of the existing return paths. The patch has been confirmed to prevent the UAF condition when tested (Kernel Patch).