CVE-2024-56624

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

iommufd: Fix out_fput in iommufd_fault_alloc()

As fput() calls the file->f_op->release op, where fault obj and ictx are

getting released, there is no need to release these two after fput() one

more time, which would result in imbalanced refcounts:

refcount_t: decrement hit 0; leaking memory.

WARNING: CPU: 48 PID: 2369 at lib/refcount.c:31 refcount_warn_saturate+0x60/0x230

Call trace:

refcount_warn_saturate+0x60/0x230 (P)

refcount_warn_saturate+0x60/0x230 (L)

iommufd_fault_fops_release+0x9c/0xe0 [iommufd]

...

VFS: Close: file count is 0 (f_op=iommufd_fops [iommufd])

WARNING: CPU: 48 PID: 2369 at fs/open.c:1507 filp_flush+0x3c/0xf0

Call trace:

filp_flush+0x3c/0xf0 (P)

filp_flush+0x3c/0xf0 (L)

__arm64_sys_close+0x34/0x98

...

imbalanced put on file reference count

WARNING: CPU: 48 PID: 2369 at fs/file.c:74 __file_ref_put+0x100/0x138

Call trace:

__file_ref_put+0x100/0x138 (P)

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References