Linux: Double Free
CVE-2024-35814 is a high-severity double free vulnerability in Linux, with a CVSS 3.1 base score of 8.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 3e7acd6e25ba77dde48c3b721c54c89cd6a10534, c88668aa6c1da240ea3eb4d128b7906e740d3cb8, 777391743771040e12cc40d3d0d178f70c616491 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.24% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to 3e7acd6e25ba77dde48c3b721c54c89cd6a10534 or c88668aa6c1da240ea3eb4d128b7906e740d3cb8 or 777391743771040e12cc40d3d0d178f70c616491 or 04867a7a33324c9c562ee7949dbcaab7aaad1fb4, whichever matches your release line, or a later version.
- Update linux_kernel to 3e7acd6e25ba or c88668aa6c1d or 777391743771 or 04867a7a3332, whichever matches your release line, or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | 0eee5ae1025699ea93d44fdb6ef2365505082103 up to, but not including, 3e7acd6e25ba77dde48c3b721c54c89cd6a10534; 0eee5ae1025699ea93d44fdb6ef2365505082103 up to, but not including, c88668aa6c1da240ea3eb4d128b7906e740d3cb8; 0eee5ae1025699ea93d44fdb6ef2365505082103 up to, but not including, 777391743771040e12cc40d3d0d178f70c616491; 0eee5ae1025699ea93d44fdb6ef2365505082103 up to, but not including, 04867a7a33324c9c562ee7949dbcaab7aaad1fb4; 6.3 | 3e7acd6e25ba77dde48c3b721c54c89cd6a10534, c88668aa6c1da240ea3eb4d128b7906e740d3cb8, 777391743771040e12cc40d3d0d178f70c616491, 04867a7a33324c9c562ee7949dbcaab7aaad1fb4 |
| Linux | linux_kernel | 0eee5ae10256 up to, but not including, 3e7acd6e25ba; 0eee5ae10256 up to, but not including, c88668aa6c1d; 0eee5ae10256 up to, but not including, 777391743771; 0eee5ae10256 up to, but not including, 04867a7a3332; 6.3 | 3e7acd6e25ba, c88668aa6c1d, 777391743771, 04867a7a3332 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- ChangedThe attack can reach beyond the vulnerable component into other systems.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. Scored by NVD.
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 3.1 | 7.8 | High | CNA |
| CVSS 3.1 | 8.8 | High | NVD |
| CVSS 3.1 | 7.1 | High | CISA (ADP) |
Official description
In the Linux kernel, the following vulnerability has been resolved: swiotlb: Fix double-allocation of slots due to broken alignment handling Commit bbb73a103fbb ("swiotlb: fix a braino in the alignment check fix"), which was a fix for commit 0eee5ae10256 ("swiotlb: fix slot alignment checks"), causes a functional regression with vsock in a virtual machine using bouncing via a restricted DMA SWIOTLB pool. When virtio allocates the virtqueues for the vsock device using dma_alloc_coherent(), the SWIOTLB search can return page-unaligned allocations if 'area->index' was left unaligned by a previous allocation from the buffer: # Final address in brackets is the SWIOTLB address returned to the caller | virtio-pci 0000:00:07.0: orig_addr 0x0 alloc_size 0x2000, iotlb_align_mask 0x800 stride 0x2: got slot 1645-1649/7168 (0x98326800) | virtio-pci 0000:00:07.0: orig_addr 0x0 alloc_size 0x2000, iotlb_align_mask 0x800 stride 0x2: got slot 1649-1653/7168 (0x98328800) | virtio-pci 0000:00:07.0: orig_addr 0x0 alloc_size 0x2000, iotlb_align_mask 0x800 stride 0x2: got slot 1653-1657/7168 (0x9832a800) This ends badly (typically buffer corruption and/or a hang) because swiotlb_alloc() is expecting a page-aligned allocation and so blindly returns a pointer to the 'struct page' corresponding to the allocation, therefore double-allocating the first half (2KiB slot) of the 4KiB page. Fix the problem by treating the allocation alignment separately to any additional alignment requirements from the device, using the maximum of the two as the stride to search the buffer slots and taking care to ensure a minimum of page-alignment for buffers larger than a page. This also resolves swiotlb allocation failures occuring due to the inclusion of ~PAGE_MASK in 'iotlb_align_mask' for large allocations and resulting in alignment requirements exceeding swiotlb_max_mapping_size().
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Double Free
The product calls free() twice on the same memory address.
How developers prevent this class of flaw
- Choose a language that provides automatic memory management.
- Ensure that each allocation is freed only once. After freeing a chunk, set the pointer to NULL to ensure the pointer cannot be freed again. In complicated error conditions, be sure that clean-up routines respect the state of allocation properly. If the language is object oriented, ensure that object destructors delete each chunk of memory only once.
- Use a static analysis tool to find double free instances.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
Recent Double Free vulnerabilities
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
Spotted an error? Tell us.