CVE-2024-40900: cachefiles: remove requests from xarray during flushing requests
In the Linux kernel, the following vulnerability has been resolved:
cachefiles: remove requests from xarray during flushing requests
Even with CACHEFILESDEAD set, we can still read the requests, so in the following concurrency the request may be used after it has been freed:
mount | daemonthread1 | daemonthread2 ------------------------------------------------------------ cachefilesondemandinitobject cachefilesondemandsendreq REQA = kzalloc(sizeof(req) + datalen) waitforcompletion(&REQA->done) cachefilesdaemonread cachefilesondemanddaemonread // close dev fd cachefilesflushreqs complete(&REQA->done) kfree(REQA) xalock(&cache->reqs); cachefilesondemandselectreq req->msg.opcode != CACHEFILESOPREAD // req use-after-free !!! xaunlock(&cache->reqs); xadestroy(&cache->reqs)
Hence remove requests from cache->reqs when flushing them to avoid accessing freed requests.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.99-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.9.7-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-40900?
CVE-2024-40900 has a high severity rating due to the potential for use-after-free vulnerabilities allowing for exploitation.
How do I fix CVE-2024-40900?
To fix CVE-2024-40900, update to the patched versions of the Linux kernel listed in the advisory, such as 5.10.223-1 or 6.1.123-1.
What systems are affected by CVE-2024-40900?
CVE-2024-40900 affects specific versions of the Linux kernel, including those from Debian, such as linux 5.10 and 6.1 series.
What type of vulnerability is CVE-2024-40900 classified as?
CVE-2024-40900 is classified as a use-after-free vulnerability in the Linux kernel's cachefiles functionality.
Is there a workaround for CVE-2024-40900?
No specific workaround is mentioned for CVE-2024-40900; patching the system is the recommended action.