CVE-2024-40913: cachefiles: defer exposing anon_fd until after copy_to_user() succeeds
In the Linux kernel, the following vulnerability has been resolved:
cachefiles: defer exposing anonfd until after copytouser() succeeds
After installing the anonymous fd, we can now see it in userland and close it. However, at this point we may not have gotten the reference count of the cache, but we will put it during colse fd, so this may cause a cache UAF.
So grab the cache reference count before fdinstall(). In addition, by kernel convention, fd is taken over by the user land after fdinstall(), and the kernel should not call closefd() after that, i.e., it should call fdinstall() after everything is ready, thus fdinstall() is called after copytouser() succeeds.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.1.95 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.6.35 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.9.6 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.10 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.99-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.9.7-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Compensating control
In cachefiles, take the cache reference count before fd_install(), and defer exposing the anonymous file descriptor until copy_to_user() succeeds; call fd_install() only after everything is ready.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-40913?
CVE-2024-40913 is classified as a high severity vulnerability affecting the Linux kernel.
How do I fix CVE-2024-40913?
To fix CVE-2024-40913, update your Linux kernel to version 6.1.95 or higher on Red Hat systems, or to the specified patched versions on Debian.
What are the affected versions for CVE-2024-40913?
CVE-2024-40913 affects Linux kernel versions prior to 6.1.95, 6.6.35, 6.9.6, and 6.10 for Red Hat, and several versions for Debian.
What is the impact of CVE-2024-40913?
The impact of CVE-2024-40913 includes potential exposure of anonymous file descriptors before proper handling.
Which Linux distributions are impacted by CVE-2024-40913?
CVE-2024-40913 impacts several distributions including Red Hat and Debian, particularly in their kernel packages.