CVE-2024-56534

What it actually does

Memory leak of iocharset string allocated via kstrdup in isofs_parse_param when mount fails in get_tree_bdev_flags before reaching isofs_fill_super, leaving opt->iocharset unfreed.

Why it matters to the business

Repeated failed mount attempts on Linux systems can gradually exhaust kernel memory, causing performance degradation, instability, or crashes on servers and endpoints handling ISO images.

How an attack unfolds

An attacker triggers repeated mount syscalls with crafted parameters on ISO images that fail early in the bdev mount path; the leak accumulates because isofs_free_fc is never reached, potentially leading to resource exhaustion. Listed threat actors have targeted similar Linux kernel memory and uninitialized resource issues in broader campaigns.

How to fix it

Upgrade the Linux kernel to commit 34f090ddb3630a26e5a6b220bf3bfaf5c7b70393 or later; for affected Ubuntu packages apply the listed squid3 updates (3.3.8-1ubuntu6.8 or 3.5.12-1ubuntu7.2) where applicable and rebuild any custom kernels incorporating the isofs fix.

How to confirm the fix worked

Verify running kernel contains the referenced commit or newer; enable kmemleak and scan for unreferenced 'utf8' allocations originating from isofs_parse_param after mount attempts.

Typical attack path

1. Obtain or create ISO image and mount point access
2. Issue mount syscall with parameters that fail the RO state check in get_tree_bdev_flags
3. Repeat the failing mount operation to accumulate unreferenced kmalloc allocations
4. Monitor for kernel memory pressure or OOM conditions

How to detect it

Search kernel logs and kmemleak reports for unreferenced objects allocated by kstrdup during isofs_parse_param; correlate with mount syscall failures in auditd or dmesg for patterns involving iocharset.

What your security team should do

• Prioritize kernel package updates across all Linux fleets within standard change windows
• Restrict unprivileged mount capabilities via mount namespaces or user namespaces where feasible
• Enable kernel memory leak detectors in test and production monitoring
• Review mount-related audit logs for anomalous failure patterns