CVE-2024-56549: cachefiles: Fix NULL pointer dereference in object->file
In the Linux kernel, the following vulnerability has been resolved:
cachefiles: Fix NULL pointer dereference in object->file
At present, the object->file has the NULL pointer dereference problem in ondemand-mode. The root cause is that the allocated fd and object->file lifetime are inconsistent, and the user-space invocation to anonfd uses object->file. Following is the process that triggers the issue:
[write fd] [umount] cachefilesondemandfdwriteiter fscachecookiestatemachine cachefileswithdrawcookie if (!file) return -ENOBUFS cachefilescleanupobject cachefilesunmarkinodeinuse fput(object->file) object->file = NULL // file NULL pointer dereference! cachefileswrite(..., file, ...)
Fix this issue by add an additional reference count to the object->file before write/llseek, and decrement after it finished.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-56549?
CVE-2024-56549 has a high severity due to the potential for a NULL pointer dereference in the Linux kernel.
How do I fix CVE-2024-56549?
To fix CVE-2024-56549, upgrade to the appropriate patched versions of the Linux kernel mentioned in security advisories.
What versions of the Linux kernel are affected by CVE-2024-56549?
CVE-2024-56549 affects Linux kernel versions from 5.19 up to 6.11.11 and also versions from 6.12 to 6.12.2.
What are the consequences of exploiting CVE-2024-56549?
Exploitation of CVE-2024-56549 could lead to system crashes or instability due to the NULL pointer dereference.
Is CVE-2024-56549 a local or remote vulnerability?
CVE-2024-56549 is considered a local vulnerability as it requires local access to exploit the NULL pointer dereference.