CVE-2024-35847

What it actually does

Double free of the area bitmap and vprop_page structures in its_vpe_irq_domain_alloc() when its_vpe_init() fails after partial interrupt allocation, due to both the error path and its_vpe_irq_domain_free() attempting to release the same memory.

Why it matters to the business

Local attackers on affected Ubuntu 24.04 LTS systems can trigger kernel memory corruption leading to crashes or potential privilege escalation; requires kernel package updates across linux, linux-aws, and linux-azure to restore stability and security.

How an attack unfolds

A local user triggers VPE interrupt domain allocation in the GICv3 ITS driver, arranges for its_vpe_init() to fail after one or more interrupts have been allocated, and reaps the resulting double-free for memory corruption or denial of service.

How to fix it

Upgrade linux to 6.8.0-50.51 or newer, linux-aws to 6.8.0-1020.22 or newer, and linux-azure to 6.8.0-1020.23 or newer on Ubuntu 24.04 LTS; reboot into the new kernel after installation.

How to confirm the fix worked

Verify running kernel version matches or exceeds the listed fixed packages; confirm absence of the double-free error path by inspecting the its_vpe_irq_domain_alloc source in the updated tree.

Typical attack path

1. Obtain local shell on an affected Ubuntu 24.04 system
2. Trigger its_vpe_irq_domain_alloc via device or driver setup that requests VPE interrupts
3. Force its_vpe_init to fail after successful allocation of at least one interrupt
4. its_vpe_irq_domain_free and the error path in alloc both release the bitmap and vprop_page
5. Exploit resulting use-after-free or corruption for code execution or crash

How to detect it

Search kernel logs and dmesg for double-free warnings, slab corruption messages, or oops traces mentioning its_vpe_irq_domain_alloc or gic-v3-its around the time of unexpected crashes or privilege-escalation attempts.

What your security team should do

• Apply the listed kernel package updates within the next maintenance window
• Prioritize systems exposed to untrusted local users
• Monitor for kernel oops or panic logs referencing gic-v3-its after patching