CVE-2024-40935: cachefiles: flush all requests after setting CACHEFILES_DEAD
In the Linux kernel, the following vulnerability has been resolved:
cachefiles: flush all requests after setting CACHEFILESDEAD
In ondemand mode, when the daemon is processing an open request, if the kernel flags the cache as CACHEFILESDEAD, the cachefilesdaemonwrite() will always return -EIO, so the daemon can't pass the copen to the kernel. Then the kernel process that is waiting for the copen triggers a hungtask.
Since the DEAD state is irreversible, it can only be exited by closing /dev/cachefiles. Therefore, after calling cachefilesioerror() to mark the cache as CACHEFILESDEAD, if in ondemand mode, flush all requests to avoid the above hungtask. We may still be able to read some of the cached data before closing the fd of /dev/cachefiles.
Note that this relies on the patch that adds reference counting to the req, otherwise it may UAF.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-40935?
CVE-2024-40935 has not been assigned a specific severity rating, but it poses risks related to the cachefiles subsystem in the Linux kernel.
How do I fix CVE-2024-40935?
To fix CVE-2024-40935, you should update to the patched versions of the Linux kernel, such as 5.10.223-1, 5.10.226-1, 6.1.123-1, or later.
Which versions of Linux are affected by CVE-2024-40935?
CVE-2024-40935 affects multiple versions of the Linux kernel prior to the patched updates in 5.10.223-1 and others.
Is CVE-2024-40935 a local or remote vulnerability?
CVE-2024-40935 is primarily a local vulnerability that can be exploited by users with access to the affected Linux system.
What component of Linux does CVE-2024-40935 affect?
CVE-2024-40935 affects the cachefiles subsystem within the Linux kernel.