CVE-2024-41058: cachefiles: fix slab-use-after-free in fscache_withdraw_volume()
cachefiles: fix slab-use-after-free in fscachewithdrawvolume()
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.1.101 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.6.42 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.9.11 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.10 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.106-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.9.11-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Compensating control
Use the new fscache_try_get_volume() helper to safely acquire the fscache_volume reference count before accessing it; when the reference count is nonzero, call cachefiles_withdraw_volume() with reference-count protection, and wait for a zero-reference fscache_volume to be removed from cache->volumes before freeing it.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-41058?
CVE-2024-41058 has a severity rating that indicates a significant impact on the Linux kernel's security, particularly concerning a slab-use-after-free issue.
How do I fix CVE-2024-41058?
To fix CVE-2024-41058, upgrade to kernel versions 6.1.101, 6.6.42, 6.9.11, 6.10, or the specific patched versions provided by your distribution.
What versions of the Linux kernel are affected by CVE-2024-41058?
CVE-2024-41058 affects versions of the Linux kernel prior to 6.1.101, 6.6.42, 6.9.11, and 6.10.
Is CVE-2024-41058 present in Debian Linux distributions?
Yes, CVE-2024-41058 is present in several Debian Linux distributions prior to the patched versions like 5.10.223-1, 6.1.123-1, and others.
What does the vulnerability CVE-2024-41058 affect in the Linux kernel?
CVE-2024-41058 affects the cachefiles subsystem within the Linux kernel, specifically relating to a flaw in the fscache_withdraw_volume function.