CVE-2024-47732

What it actually does

Use-after-free condition in the iaa crypto driver's free_device_compression_mode function where device_mode is freed before being passed to iaa_compression_modes[i]->free().

Why it matters to the business

Low immediate risk of kernel instability or privilege escalation because the affected code path is currently dead; however, future implementations of the free callback could expose systems to memory corruption if not updated.

How an attack unfolds

An attacker would need to trigger iaa compression mode cleanup on a device, causing the use-after-free when the callback is invoked; given that no free() implementation exists today, practical exploitation requires an attacker to first supply a malicious free handler, which has not been observed in the listed threat actor campaigns.

How to fix it

Apply the kernel fix from commit b5d534b473e2c8d3e4560be2dd6c12a8eb9d61e9 or later; for Rocky Linux 8 packages update rubygem-abrt to 0:0.3.0-4.module+el8.5.0+738+032c9c02, rubygem-bson to 0:4.3.0-2.module+el8.4.0+592+03ff458a, rubygem-bundler to 0:1.16.1-3.module+el8.3.0+167+5c390590, rubygem-mongo to 0:2.5.1-2.module+el8.4.0+592+03ff458a, rubygem-mysql2 to 0:0.4.10-4.module+el8.5.0+739+43897a5e, and rubygem-pg to 0:1.0.0-2.module+el8.4.0+592+03ff458a.

How to confirm the fix worked

Confirm the presence of commit b5d534b473e2c8d3e4560be2dd6c12a8eb9d61e9 in the running kernel source or verify package versions match the listed fixed releases; inspect iaa driver code to ensure device_mode is no longer used after free_device_compression_mode returns.

Typical attack path

1. Identify systems using the iaa crypto driver
2. Trigger device compression mode allocation and subsequent free path
3. Supply or wait for a free() callback implementation to dereference the already-freed object
4. Leverage resulting memory corruption for kernel code execution or denial of service

How to detect it

Search kernel logs and crash dumps for iaa driver oopses or warnings referencing compression_mode or free_device_compression_mode; review audit trails for unexpected iaa device initialization on systems that do not normally use Intel Analytics Accelerator hardware.

What your security team should do

• Prioritize kernel updates on any system exposing the iaa crypto driver
• Monitor upstream Linux stable trees for backports of the referenced commit
• Review custom iaa compression mode implementations for free() callbacks before deployment