CVE-2024-39510: cachefiles: fix slab-use-after-free in cachefiles_ondemand_daemon_read()
In the Linux kernel, the following vulnerability has been resolved:
cachefiles: fix slab-use-after-free in cachefilesondemanddaemonread()
We got the following issue in a fuzz test of randomly issuing the restore command:
================================================================== BUG: KASAN: slab-use-after-free in cachefilesondemanddaemonread+0xb41/0xb60 Read of size 8 at addr ffff888122e84088 by task ondemand-04-dae/963
CPU: 13 PID: 963 Comm: ondemand-04-dae Not tainted 6.8.0-dirty #564 Call Trace: kasanreport+0x93/0xc0 cachefilesondemanddaemonread+0xb41/0xb60 vfsread+0x169/0xb50 ksysread+0xf5/0x1e0
Allocated by task 116: kmemcachealloc+0x140/0x3a0 cachefileslookupcookie+0x140/0xcd0 fscachecookiestatemachine+0x43c/0x1230 [...]
Freed by task 792: kmemcachefree+0xfe/0x390 cachefilesputobject+0x241/0x480 fscachecookiestatemachine+0x5c8/0x1230 [...] ==================================================================
Following is the process that triggers the issue:
mount | daemonthread1 | daemonthread2 ------------------------------------------------------------ cachefileswithdrawcookie cachefilesondemandcleanobject(object) cachefilesondemandsendreq REQA = kzalloc(sizeof(req) + datalen) waitforcompletion(&REQA->done)
cachefilesdaemonread cachefilesondemanddaemonread REQA = cachefilesondemandselectreq msg->objectid = req->object->ondemand->ondemandid ------ restore ------ cachefilesondemandrestore xasforeach(&xas, req, ULONGMAX) xassetmark(&xas, CACHEFILESREQNEW)
cachefilesdaemonread cachefilesondemanddaemonread REQA = cachefilesondemandselectreq copytouser(buffer, msg, n) xaerase(&cache->reqs, id) complete(&REQA->done) ------ close(fd) ------ cachefilesondemandfdrelease cachefilesputobject cachefilesputobject kmemcachefree(cachefilesobjectjar, object) REQA->object->ondemand->ondemandid // object UAF !!!
When we see the request within xalock, req->object must not have been freed yet, so grab the reference count of object before xaunlock to avoid the above issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-39510?
CVE-2024-39510 is categorized as a moderate severity vulnerability in the Linux kernel.
How do I fix CVE-2024-39510?
To fix CVE-2024-39510, update to a patched version of the Linux kernel that addresses this vulnerability.
Which versions of the Linux kernel are affected by CVE-2024-39510?
CVE-2024-39510 affects Linux kernel versions up to 6.9.6 and several release candidates of 6.10.
What type of vulnerability is CVE-2024-39510?
CVE-2024-39510 is a slab-use-after-free vulnerability found in the cachefiles component of the Linux kernel.
Can CVE-2024-39510 be exploited remotely?
Exploitation of CVE-2024-39510 typically requires local access, diminishing the risk of remote exploitation.