CVE-2024-47748

What it actually does

Use-after-free in Linux kernel vhost_vdpa due to incorrect binding of irq_bypass producer token to eventfd_ctx lifecycle, allowing token use after release during VHOST_SET_VRING_CALL and set_status interactions when DRIVER_OK is set.

Why it matters to the business

Potential kernel crashes, memory corruption, or privilege escalation on affected Linux systems using vDPA/vhost, increasing downtime and security risk for virtualized environments; low exploit likelihood but requires prompt kernel updates given stable low EPSS and absence from KEV.

How an attack unfolds

An attacker with local access crafts vhost/vdpa operations to trigger VHOST_SET_VRING_CALL followed by set_status calls, causing the irq bypass producer to reference a freed eventfd token and resulting in use-after-free; no specific threat actors tied to this CVE despite broad mentions of espionage campaigns targeting Linux kernel flaws.

How to fix it

Update the Linux kernel to the fixed commit 0c170b1e918b9afac25e2bbd01eaa2bfc0ece8c0 or later stable releases; ensure DRIVER_OK handling properly binds token registration to VHOST_SET_VRING_CALL and unregisters before vhost_vring_ioctl.

How to confirm the fix worked

Verify kernel source or binary contains commit 0c170b1e918b9afac25e2bbd01eaa2bfc0ece8c0; test vhost_vdpa setup paths with eventfd release sequences to confirm no UAF occurs.

Typical attack path

1. Obtain local access on target Linux system with vhost_vdpa enabled
2. Issue VHOST_SET_VRING_CALL ioctl to register producer token
3. Trigger set_status or related vring operations to invoke setup_vq_irq
4. Release eventfd context while producer remains registered
5. Trigger use of dangling token to induce UAF

How to detect it

Search kernel logs for vhost_vdpa and irq_bypass related oops or warnings around eventfd and VHOST ioctls; correlate with process activity performing vring setup on systems using vDPA.

What your security team should do

• Apply kernel patch containing 0c170b1e918b9afac25e2bbd01eaa2bfc0ece8c0 immediately on affected systems
• Monitor for downstream kernel package updates in distributions
• Review vhost/vdpa usage in virtualized workloads and restrict untrusted access
• Audit for similar token lifecycle issues in other vhost code paths