Executive brief
The Linux kernel's CPU reverse-mapping library contains a memory safety bug in its interrupt notifier cleanup code. When IRQ notifiers are removed, stale pointers can remain in the rmap array, causing the kernel to attempt to free already-freed memory on subsequent cleanup operations. This could allow a local attacker with appropriate capabilities to trigger a use-after-free condition, potentially leading to kernel crash or privilege escalation.
Technical details
The vulnerability is a use-after-free in lib/cpu_rmap.c affecting the IRQ affinity notifier mechanism. When irq_set_affinity_notifier() is called with NULL to unregister a notifier, the glue structure is freed but its pointer remains in the rmap->obj array. Subsequent calls to free_irq_cpu_rmap() iterate over this array without checking for NULL entries, attempting to dereference and free already-freed memory. The fix involves: (1) setting array entries to NULL after freeing in irq_cpu_rmap_release(), (2) adding a NULL check in irq_cpu_rmap_add() error path, and (3) checking for non-NULL entries in free_irq_cpu_rmap() before dereferencing. The vulnerability requires local code execution and specific sequencing of IRQ notifier operations to trigger.
Affected products
- Linux Linux kernel multiple versions (see git history for affected versions)
Timeline
- 2023-02-08: disclosed: Original fix commit by Eli Cohen
- 2023-03-24: patched: Merged to mainline
- 2023-05-24: patched: Backported to stable kernels