CVE-2023-33250

What it actually does

Use-after-free in iopt_unmap_iova_range within the IOMMU pagetable code allows a privileged local process to reference freed kernel memory during IOVA range unmapping, resulting in memory corruption or denial of service.

Why it matters to the business

Systems running affected Linux kernel versions may experience unexpected crashes or loss of availability when the flaw is triggered by a local administrator or service; the issue has been public for over three years with negligible observed exploitation.

How an attack unfolds

An attacker with root privileges on a vulnerable Linux host crafts IOMMU operations that cause the iommufd code to free a pagetable entry and then reuse the dangling pointer during unmap, leading to kernel instability.

How to fix it

Update the Linux kernel to a version containing commit 804ca14d04df09bf7924bacc5ad22a4bed80c94f or later; rebuild and reboot with the patched kernel image.

How to confirm the fix worked

Verify the running kernel contains commit 804ca14d04df09bf7924bacc5ad22a4bed80c94f via git log or kernel version string; test IOMMU unmap workloads to confirm stability.

Typical attack path

1. Obtain local root or high-privilege access on the target system
2. Load or invoke code that exercises iommufd IOMMU mapping and unmapping paths
3. Trigger repeated map/unmap sequences to induce the use-after-free
4. Observe kernel panic or memory corruption resulting in denial of service

How to detect it

Review kernel logs for oops or panic messages referencing iopt_unmap_iova_range or drivers/iommu/iommufd/io_pagetable.c; correlate with processes performing IOMMU map/unmap operations.

What your security team should do

• Prioritize kernel upgrade on any systems still running Linux 6.3 or equivalent unpatched builds
• Restrict IOMMU and iommufd usage to only trusted administrative processes
• Monitor for kernel oops/panic reports involving iommufd or io_pagetable
• Apply the fix even on low-EPSS issues when the host is reachable by untrusted local users