CVE-2024-41057 (GCVE-0-2024-41057)
Vulnerability from cvelistv5 – Published: 2024-07-29 14:57 – Updated: 2026-08-05 11:35
VLAI
EPSS
VEX
Title
cachefiles: fix slab-use-after-free in cachefiles_withdraw_cookie()
Summary
In the Linux kernel, the following vulnerability has been resolved:
cachefiles: fix slab-use-after-free in cachefiles_withdraw_cookie()
We got the following issue in our fault injection stress test:
==================================================================
BUG: KASAN: slab-use-after-free in cachefiles_withdraw_cookie+0x4d9/0x600
Read of size 8 at addr ffff888118efc000 by task kworker/u78:0/109
CPU: 13 PID: 109 Comm: kworker/u78:0 Not tainted 6.8.0-dirty #566
Call Trace:
<TASK>
kasan_report+0x93/0xc0
cachefiles_withdraw_cookie+0x4d9/0x600
fscache_cookie_state_machine+0x5c8/0x1230
fscache_cookie_worker+0x91/0x1c0
process_one_work+0x7fa/0x1800
[...]
Allocated by task 117:
kmalloc_trace+0x1b3/0x3c0
cachefiles_acquire_volume+0xf3/0x9c0
fscache_create_volume_work+0x97/0x150
process_one_work+0x7fa/0x1800
[...]
Freed by task 120301:
kfree+0xf1/0x2c0
cachefiles_withdraw_cache+0x3fa/0x920
cachefiles_put_unbind_pincount+0x1f6/0x250
cachefiles_daemon_release+0x13b/0x290
__fput+0x204/0xa00
task_work_run+0x139/0x230
do_exit+0x87a/0x29b0
[...]
==================================================================
Following is the process that triggers the issue:
p1 | p2
------------------------------------------------------------
fscache_begin_lookup
fscache_begin_volume_access
fscache_cache_is_live(fscache_cache)
cachefiles_daemon_release
cachefiles_put_unbind_pincount
cachefiles_daemon_unbind
cachefiles_withdraw_cache
fscache_withdraw_cache
fscache_set_cache_state(cache, FSCACHE_CACHE_IS_WITHDRAWN);
cachefiles_withdraw_objects(cache)
fscache_wait_for_objects(fscache)
atomic_read(&fscache_cache->object_count) == 0
fscache_perform_lookup
cachefiles_lookup_cookie
cachefiles_alloc_object
refcount_set(&object->ref, 1);
object->volume = volume
fscache_count_object(vcookie->cache);
atomic_inc(&fscache_cache->object_count)
cachefiles_withdraw_volumes
cachefiles_withdraw_volume
fscache_withdraw_volume
__cachefiles_free_volume
kfree(cachefiles_volume)
fscache_cookie_state_machine
cachefiles_withdraw_cookie
cache = object->volume->cache;
// cachefiles_volume UAF !!!
After setting FSCACHE_CACHE_IS_WITHDRAWN, wait for all the cookie lookups
to complete first, and then wait for fscache_cache->object_count == 0 to
avoid the cookie exiting after the volume has been freed and triggering
the above issue. Therefore call fscache_withdraw_volume() before calling
cachefiles_withdraw_objects().
This way, after setting FSCACHE_CACHE_IS_WITHDRAWN, only the following two
cases will occur:
1) fscache_begin_lookup fails in fscache_begin_volume_access().
2) fscache_withdraw_volume() will ensure that fscache_count_object() has
been executed before calling fscache_wait_for_objects().
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 16:22 UTC
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
fe2140e2f57fef8562e0f9b7cd447d2b08dc2f35 , < 8de253177112a47c9af157d23ae934779188b4e1
(git)
Affected: fe2140e2f57fef8562e0f9b7cd447d2b08dc2f35 , < 9e67589a4a7b7e5660b524d1d5fe61242bcbcc11 (git) Affected: fe2140e2f57fef8562e0f9b7cd447d2b08dc2f35 , < ef81340401e8a371d6b17f69e76d861920972cfe (git) Affected: fe2140e2f57fef8562e0f9b7cd447d2b08dc2f35 , < 5d8f805789072ea7fd39504694b7bd17e5f751c4 (git) |
guessed | |
| Linux | Linux |
Affected:
5.17
Unaffected: 0 , < 5.17 (semver) Unaffected: 6.1.101 , ≤ 6.1.* (semver) Unaffected: 6.6.42 , ≤ 6.6.* (semver) Unaffected: 6.9.11 , ≤ 6.9.* (semver) Unaffected: 6.10 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2025-11-03T21:59:57.420Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/8de253177112a47c9af157d23ae934779188b4e1"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/9e67589a4a7b7e5660b524d1d5fe61242bcbcc11"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/ef81340401e8a371d6b17f69e76d861920972cfe"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/5d8f805789072ea7fd39504694b7bd17e5f751c4"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-41057",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-10T16:22:21.821093Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-11T17:32:57.641Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/cachefiles/cache.c",
"fs/cachefiles/volume.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8de253177112a47c9af157d23ae934779188b4e1",
"status": "affected",
"version": "fe2140e2f57fef8562e0f9b7cd447d2b08dc2f35",
"versionType": "git"
},
{
"lessThan": "9e67589a4a7b7e5660b524d1d5fe61242bcbcc11",
"status": "affected",
"version": "fe2140e2f57fef8562e0f9b7cd447d2b08dc2f35",
"versionType": "git"
},
{
"lessThan": "ef81340401e8a371d6b17f69e76d861920972cfe",
"status": "affected",
"version": "fe2140e2f57fef8562e0f9b7cd447d2b08dc2f35",
"versionType": "git"
},
{
"lessThan": "5d8f805789072ea7fd39504694b7bd17e5f751c4",
"status": "affected",
"version": "fe2140e2f57fef8562e0f9b7cd447d2b08dc2f35",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/cachefiles/cache.c",
"fs/cachefiles/volume.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.17"
},
{
"lessThan": "5.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.9.*",
"status": "unaffected",
"version": "6.9.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.10",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.101",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.42",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.9.11",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.10",
"versionStartIncluding": "5.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncachefiles: fix slab-use-after-free in cachefiles_withdraw_cookie()\n\nWe got the following issue in our fault injection stress test:\n\n==================================================================\nBUG: KASAN: slab-use-after-free in cachefiles_withdraw_cookie+0x4d9/0x600\nRead of size 8 at addr ffff888118efc000 by task kworker/u78:0/109\n\nCPU: 13 PID: 109 Comm: kworker/u78:0 Not tainted 6.8.0-dirty #566\nCall Trace:\n \u003cTASK\u003e\n kasan_report+0x93/0xc0\n cachefiles_withdraw_cookie+0x4d9/0x600\n fscache_cookie_state_machine+0x5c8/0x1230\n fscache_cookie_worker+0x91/0x1c0\n process_one_work+0x7fa/0x1800\n [...]\n\nAllocated by task 117:\n kmalloc_trace+0x1b3/0x3c0\n cachefiles_acquire_volume+0xf3/0x9c0\n fscache_create_volume_work+0x97/0x150\n process_one_work+0x7fa/0x1800\n [...]\n\nFreed by task 120301:\n kfree+0xf1/0x2c0\n cachefiles_withdraw_cache+0x3fa/0x920\n cachefiles_put_unbind_pincount+0x1f6/0x250\n cachefiles_daemon_release+0x13b/0x290\n __fput+0x204/0xa00\n task_work_run+0x139/0x230\n do_exit+0x87a/0x29b0\n [...]\n==================================================================\n\nFollowing is the process that triggers the issue:\n\n p1 | p2\n------------------------------------------------------------\n fscache_begin_lookup\n fscache_begin_volume_access\n fscache_cache_is_live(fscache_cache)\ncachefiles_daemon_release\n cachefiles_put_unbind_pincount\n cachefiles_daemon_unbind\n cachefiles_withdraw_cache\n fscache_withdraw_cache\n fscache_set_cache_state(cache, FSCACHE_CACHE_IS_WITHDRAWN);\n cachefiles_withdraw_objects(cache)\n fscache_wait_for_objects(fscache)\n atomic_read(\u0026fscache_cache-\u003eobject_count) == 0\n fscache_perform_lookup\n cachefiles_lookup_cookie\n cachefiles_alloc_object\n refcount_set(\u0026object-\u003eref, 1);\n object-\u003evolume = volume\n fscache_count_object(vcookie-\u003ecache);\n atomic_inc(\u0026fscache_cache-\u003eobject_count)\n cachefiles_withdraw_volumes\n cachefiles_withdraw_volume\n fscache_withdraw_volume\n __cachefiles_free_volume\n kfree(cachefiles_volume)\n fscache_cookie_state_machine\n cachefiles_withdraw_cookie\n cache = object-\u003evolume-\u003ecache;\n // cachefiles_volume UAF !!!\n\nAfter setting FSCACHE_CACHE_IS_WITHDRAWN, wait for all the cookie lookups\nto complete first, and then wait for fscache_cache-\u003eobject_count == 0 to\navoid the cookie exiting after the volume has been freed and triggering\nthe above issue. Therefore call fscache_withdraw_volume() before calling\ncachefiles_withdraw_objects().\n\nThis way, after setting FSCACHE_CACHE_IS_WITHDRAWN, only the following two\ncases will occur:\n1) fscache_begin_lookup fails in fscache_begin_volume_access().\n2) fscache_withdraw_volume() will ensure that fscache_count_object() has\n been executed before calling fscache_wait_for_objects()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached through local filesystem activity \u2014 `__fscache_use_cookie()` on an fscache-backed mount plus the local `/dev/cachefiles` daemon fd lifecycle. No remote peer data reaches `cachefiles_withdraw_cookie()`, so this requires local access.\nAC:L - The attacker fully drives the racing side by keeping a flood of cookie lookups in flight (repeated opens of uncached files on the fscache-backed mount), so the narrow window between `fscache_wait_for_objects()` and `cachefiles_withdraw_volumes()` is reliably occupied; heap grooming of the 4KB slab is likewise attacker-controlled.\nPR:L - Triggering the lookup side needs only an unprivileged local user with read access to an fscache-enabled netfs or erofs-over-fscache mount \u2014 `__fscache_use_cookie()` is invoked on ordinary file open with no capability check.\nUI:N - No victim action is required; the attacker\u0027s own file opens generate the cookie lookups, and the cache withdrawal is a routine daemon-lifecycle event.\nS:U - The corruption and its consequences are confined to the kernel\u0027s own security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - The slab-use-after-free reads `object-\u003evolume-\u003ecache` from a freed kmalloc-4k object, and the resulting pointer is dereferenced repeatedly, letting an attacker who reclaims the slab redirect reads to arbitrary kernel memory and disclose it.\nI:H - The stale `cache` pointer is used for `spin_lock(\u0026cache-\u003eobject_list_lock)` and `override_creds(cache-\u003ecache_cred)` in `cachefiles_begin_secure()`, giving both an arbitrary-address write and attacker-chosen credential installation \u2014 a direct path to privilege escalation.\nA:H - Even unexploited, the use-after-free dereferences garbage in a workqueue context (`fscache_cookie_worker`), producing an oops or panic as shown by the KASAN report."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T11:35:03.575Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8de253177112a47c9af157d23ae934779188b4e1"
},
{
"url": "https://git.kernel.org/stable/c/9e67589a4a7b7e5660b524d1d5fe61242bcbcc11"
},
{
"url": "https://git.kernel.org/stable/c/ef81340401e8a371d6b17f69e76d861920972cfe"
},
{
"url": "https://git.kernel.org/stable/c/5d8f805789072ea7fd39504694b7bd17e5f751c4"
}
],
"title": "cachefiles: fix slab-use-after-free in cachefiles_withdraw_cookie()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-41057",
"datePublished": "2024-07-29T14:57:19.938Z",
"dateReserved": "2024-07-12T12:17:45.627Z",
"dateUpdated": "2026-08-05T11:35:03.575Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2024-41057",
"date": "2026-09-15",
"epss": "0.00278",
"percentile": "0.2029"
},
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.17\", \"versionEndExcluding\": \"6.1.101\", \"matchCriteriaId\": \"DB356B3F-4040-49B4-8BB9-E2643A2E9B13\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.2\", \"versionEndExcluding\": \"6.6.42\", \"matchCriteriaId\": \"972274A2-D688-4C37-BE42-689B58B4C225\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.9.11\", \"matchCriteriaId\": \"01E300B3-8B39-4A2D-8B03-4631433D3915\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncachefiles: fix slab-use-after-free in cachefiles_withdraw_cookie()\\n\\nWe got the following issue in our fault injection stress test:\\n\\n==================================================================\\nBUG: KASAN: slab-use-after-free in cachefiles_withdraw_cookie+0x4d9/0x600\\nRead of size 8 at addr ffff888118efc000 by task kworker/u78:0/109\\n\\nCPU: 13 PID: 109 Comm: kworker/u78:0 Not tainted 6.8.0-dirty #566\\nCall Trace:\\n \u003cTASK\u003e\\n kasan_report+0x93/0xc0\\n cachefiles_withdraw_cookie+0x4d9/0x600\\n fscache_cookie_state_machine+0x5c8/0x1230\\n fscache_cookie_worker+0x91/0x1c0\\n process_one_work+0x7fa/0x1800\\n [...]\\n\\nAllocated by task 117:\\n kmalloc_trace+0x1b3/0x3c0\\n cachefiles_acquire_volume+0xf3/0x9c0\\n fscache_create_volume_work+0x97/0x150\\n process_one_work+0x7fa/0x1800\\n [...]\\n\\nFreed by task 120301:\\n kfree+0xf1/0x2c0\\n cachefiles_withdraw_cache+0x3fa/0x920\\n cachefiles_put_unbind_pincount+0x1f6/0x250\\n cachefiles_daemon_release+0x13b/0x290\\n __fput+0x204/0xa00\\n task_work_run+0x139/0x230\\n do_exit+0x87a/0x29b0\\n [...]\\n==================================================================\\n\\nFollowing is the process that triggers the issue:\\n\\n p1 | p2\\n------------------------------------------------------------\\n fscache_begin_lookup\\n fscache_begin_volume_access\\n fscache_cache_is_live(fscache_cache)\\ncachefiles_daemon_release\\n cachefiles_put_unbind_pincount\\n cachefiles_daemon_unbind\\n cachefiles_withdraw_cache\\n fscache_withdraw_cache\\n fscache_set_cache_state(cache, FSCACHE_CACHE_IS_WITHDRAWN);\\n cachefiles_withdraw_objects(cache)\\n fscache_wait_for_objects(fscache)\\n atomic_read(\u0026fscache_cache-\u003eobject_count) == 0\\n fscache_perform_lookup\\n cachefiles_lookup_cookie\\n cachefiles_alloc_object\\n refcount_set(\u0026object-\u003eref, 1);\\n object-\u003evolume = volume\\n fscache_count_object(vcookie-\u003ecache);\\n atomic_inc(\u0026fscache_cache-\u003eobject_count)\\n cachefiles_withdraw_volumes\\n cachefiles_withdraw_volume\\n fscache_withdraw_volume\\n __cachefiles_free_volume\\n kfree(cachefiles_volume)\\n fscache_cookie_state_machine\\n cachefiles_withdraw_cookie\\n cache = object-\u003evolume-\u003ecache;\\n // cachefiles_volume UAF !!!\\n\\nAfter setting FSCACHE_CACHE_IS_WITHDRAWN, wait for all the cookie lookups\\nto complete first, and then wait for fscache_cache-\u003eobject_count == 0 to\\navoid the cookie exiting after the volume has been freed and triggering\\nthe above issue. Therefore call fscache_withdraw_volume() before calling\\ncachefiles_withdraw_objects().\\n\\nThis way, after setting FSCACHE_CACHE_IS_WITHDRAWN, only the following two\\ncases will occur:\\n1) fscache_begin_lookup fails in fscache_begin_volume_access().\\n2) fscache_withdraw_volume() will ensure that fscache_count_object() has\\n been executed before calling fscache_wait_for_objects().\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se resolvi\\u00f3 la siguiente vulnerabilidad: cachefiles: fix slab-use-after-free in cachefiles_withdraw_cookie() Recibimos el siguiente problema en nuestra prueba de estr\\u00e9s de inyecci\\u00f3n de fallos: ============ ==================================================== ==== ERROR: KASAN: slab-use-after-free en cachefiles_withdraw_cookie+0x4d9/0x600 Lectura de tama\\u00f1o 8 en la direcci\\u00f3n ffff888118efc000 por tarea kworker/u78:0/109 CPU: 13 PID: 109 Comm: kworker/u78:0 No contaminado 6.8.0-dirty #566 Seguimiento de llamadas: kasan_report+0x93/0xc0 cachefiles_withdraw_cookie+0x4d9/0x600 fscache_cookie_state_machine+0x5c8/0x1230 fscache_cookie_worker+0x91/0x1c0 Process_one_work+0x7fa/0x1800 [...] Asignado por la tarea 117: kmalloc_trace+0x1b3/0x3c0 cachefiles_acquire_volume+0xf3/0x9c0 fscache_create_volume_work+0x97/0x150 Process_one_work+0x7fa/0x1800 [...] Liberado por la tarea 120301: kfree+0xf1/0x2c0 cachefiles_withdraw_cache+0x3fa/0x92 0 cachefiles_put_unbind_pincount+0x1f6/0x250 cachefiles_daemon_release+0x13b/0x290 __fput+0x204/0xa00 task_work_run+0x139/0x230 do_exit+0x87a/0x29b0 [...] ================================ ==================================== El siguiente es el proceso que desencadena el problema: p1 | p2 ------------------------------------------------- ----------- fscache_begin_lookup fscache_begin_volume_access fscache_cache_is_live(fscache_cache) cachefiles_daemon_release cachefiles_put_unbind_pincount cachefiles_daemon_unbind cachefiles_withdraw_cache fscache_withdraw_cache fscache_set_cache_state(cache, FSCACHE_CACHE_IS_WITHDRAWN); cachefiles_withdraw_objects(cache) fscache_wait_for_objects(fscache) atomic_read(\u0026amp;fscache_cache-\u0026gt;object_count) == 0 fscache_perform_lookup cachefiles_lookup_cookie cachefiles_alloc_object refcount_set(\u0026amp;object-\u0026gt;ref, 1); objeto-\u0026gt;volumen = volumen fscache_count_object(vcookie-\u0026gt;cache); atomic_inc(\u0026amp;fscache_cache-\u0026gt;object_count) cachefiles_withdraw_volumes cachefiles_withdraw_volume fscache_withdraw_volume __cachefiles_free_volume kfree(cachefiles_volume) fscache_cookie_state_machine cachefiles_withdraw_cookie cache = objeto-\u0026gt;volumen-\u0026gt;cache; // archivos_cach\\u00e9_volumen UAF !!! Despu\\u00e9s de configurar FSCACHE_CACHE_IS_WITHDRAWN, primero espere a que se completen todas las b\\u00fasquedas de cookies y luego espere a que fscache_cache-\u0026gt;object_count == 0 para evitar que la cookie salga despu\\u00e9s de que se haya liberado el volumen y desencadene el problema anterior. Por lo tanto, llame a fscache_withdraw_volume() antes de llamar a cachefiles_withdraw_objects(). De esta manera, despu\\u00e9s de configurar FSCACHE_CACHE_IS_WITHDRAWN, solo ocurrir\\u00e1n los dos casos siguientes: 1) fscache_begin_lookup falla en fscache_begin_volume_access(). 2) fscache_withdraw_volume() garantizar\\u00e1 que fscache_count_object() se haya ejecutado antes de llamar a fscache_wait_for_objects().\"}]",
"id": "CVE-2024-41057",
"lastModified": "2024-11-21T09:32:09.390",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}]}",
"published": "2024-07-29T15:15:13.773",
"references": "[{\"url\": \"https://git.kernel.org/stable/c/5d8f805789072ea7fd39504694b7bd17e5f751c4\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/8de253177112a47c9af157d23ae934779188b4e1\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/9e67589a4a7b7e5660b524d1d5fe61242bcbcc11\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/ef81340401e8a371d6b17f69e76d861920972cfe\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/5d8f805789072ea7fd39504694b7bd17e5f751c4\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/8de253177112a47c9af157d23ae934779188b4e1\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/9e67589a4a7b7e5660b524d1d5fe61242bcbcc11\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/ef81340401e8a371d6b17f69e76d861920972cfe\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}]",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-416\"}]}]"
},
"microsoft_vex": {
"current_release_date": "2026-02-18T15:09:48.000Z",
"cve": "CVE-2024-41057",
"id": "msrc_CVE-2024-41057",
"initial_release_date": "2024-07-01T07:00:00.000Z",
"product_status:fixed": "2",
"product_status:known_affected": "2",
"source": "Microsoft CSAF VEX",
"status": "final",
"title": "cachefiles: fix slab-use-after-free in cachefiles_withdraw_cookie()",
"url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-41057.json",
"version": "3"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2024-41057\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-07-29T15:15:13.773\",\"lastModified\":\"2026-08-04T11:19:23.943\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncachefiles: fix slab-use-after-free in cachefiles_withdraw_cookie()\\n\\nWe got the following issue in our fault injection stress test:\\n\\n==================================================================\\nBUG: KASAN: slab-use-after-free in cachefiles_withdraw_cookie+0x4d9/0x600\\nRead of size 8 at addr ffff888118efc000 by task kworker/u78:0/109\\n\\nCPU: 13 PID: 109 Comm: kworker/u78:0 Not tainted 6.8.0-dirty #566\\nCall Trace:\\n \u003cTASK\u003e\\n kasan_report+0x93/0xc0\\n cachefiles_withdraw_cookie+0x4d9/0x600\\n fscache_cookie_state_machine+0x5c8/0x1230\\n fscache_cookie_worker+0x91/0x1c0\\n process_one_work+0x7fa/0x1800\\n [...]\\n\\nAllocated by task 117:\\n kmalloc_trace+0x1b3/0x3c0\\n cachefiles_acquire_volume+0xf3/0x9c0\\n fscache_create_volume_work+0x97/0x150\\n process_one_work+0x7fa/0x1800\\n [...]\\n\\nFreed by task 120301:\\n kfree+0xf1/0x2c0\\n cachefiles_withdraw_cache+0x3fa/0x920\\n cachefiles_put_unbind_pincount+0x1f6/0x250\\n cachefiles_daemon_release+0x13b/0x290\\n __fput+0x204/0xa00\\n task_work_run+0x139/0x230\\n do_exit+0x87a/0x29b0\\n [...]\\n==================================================================\\n\\nFollowing is the process that triggers the issue:\\n\\n p1 | p2\\n------------------------------------------------------------\\n fscache_begin_lookup\\n fscache_begin_volume_access\\n fscache_cache_is_live(fscache_cache)\\ncachefiles_daemon_release\\n cachefiles_put_unbind_pincount\\n cachefiles_daemon_unbind\\n cachefiles_withdraw_cache\\n fscache_withdraw_cache\\n fscache_set_cache_state(cache, FSCACHE_CACHE_IS_WITHDRAWN);\\n cachefiles_withdraw_objects(cache)\\n fscache_wait_for_objects(fscache)\\n atomic_read(\u0026fscache_cache-\u003eobject_count) == 0\\n fscache_perform_lookup\\n cachefiles_lookup_cookie\\n cachefiles_alloc_object\\n refcount_set(\u0026object-\u003eref, 1);\\n object-\u003evolume = volume\\n fscache_count_object(vcookie-\u003ecache);\\n atomic_inc(\u0026fscache_cache-\u003eobject_count)\\n cachefiles_withdraw_volumes\\n cachefiles_withdraw_volume\\n fscache_withdraw_volume\\n __cachefiles_free_volume\\n kfree(cachefiles_volume)\\n fscache_cookie_state_machine\\n cachefiles_withdraw_cookie\\n cache = object-\u003evolume-\u003ecache;\\n // cachefiles_volume UAF !!!\\n\\nAfter setting FSCACHE_CACHE_IS_WITHDRAWN, wait for all the cookie lookups\\nto complete first, and then wait for fscache_cache-\u003eobject_count == 0 to\\navoid the cookie exiting after the volume has been freed and triggering\\nthe above issue. Therefore call fscache_withdraw_volume() before calling\\ncachefiles_withdraw_objects().\\n\\nThis way, after setting FSCACHE_CACHE_IS_WITHDRAWN, only the following two\\ncases will occur:\\n1) fscache_begin_lookup fails in fscache_begin_volume_access().\\n2) fscache_withdraw_volume() will ensure that fscache_count_object() has\\n been executed before calling fscache_wait_for_objects().\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: cachefiles: fix slab-use-after-free in cachefiles_withdraw_cookie() Recibimos el siguiente problema en nuestra prueba de estr\u00e9s de inyecci\u00f3n de fallos: ============ ==================================================== ==== ERROR: KASAN: slab-use-after-free en cachefiles_withdraw_cookie+0x4d9/0x600 Lectura de tama\u00f1o 8 en la direcci\u00f3n ffff888118efc000 por tarea kworker/u78:0/109 CPU: 13 PID: 109 Comm: kworker/u78:0 No contaminado 6.8.0-dirty #566 Seguimiento de llamadas: kasan_report+0x93/0xc0 cachefiles_withdraw_cookie+0x4d9/0x600 fscache_cookie_state_machine+0x5c8/0x1230 fscache_cookie_worker+0x91/0x1c0 Process_one_work+0x7fa/0x1800 [...] Asignado por la tarea 117: kmalloc_trace+0x1b3/0x3c0 cachefiles_acquire_volume+0xf3/0x9c0 fscache_create_volume_work+0x97/0x150 Process_one_work+0x7fa/0x1800 [...] Liberado por la tarea 120301: kfree+0xf1/0x2c0 cachefiles_withdraw_cache+0x3fa/0x92 0 cachefiles_put_unbind_pincount+0x1f6/0x250 cachefiles_daemon_release+0x13b/0x290 __fput+0x204/0xa00 task_work_run+0x139/0x230 do_exit+0x87a/0x29b0 [...] ================================ ==================================== El siguiente es el proceso que desencadena el problema: p1 | p2 ------------------------------------------------- ----------- fscache_begin_lookup fscache_begin_volume_access fscache_cache_is_live(fscache_cache) cachefiles_daemon_release cachefiles_put_unbind_pincount cachefiles_daemon_unbind cachefiles_withdraw_cache fscache_withdraw_cache fscache_set_cache_state(cache, FSCACHE_CACHE_IS_WITHDRAWN); cachefiles_withdraw_objects(cache) fscache_wait_for_objects(fscache) atomic_read(\u0026amp;fscache_cache-\u0026gt;object_count) == 0 fscache_perform_lookup cachefiles_lookup_cookie cachefiles_alloc_object refcount_set(\u0026amp;object-\u0026gt;ref, 1); objeto-\u0026gt;volumen = volumen fscache_count_object(vcookie-\u0026gt;cache); atomic_inc(\u0026amp;fscache_cache-\u0026gt;object_count) cachefiles_withdraw_volumes cachefiles_withdraw_volume fscache_withdraw_volume __cachefiles_free_volume kfree(cachefiles_volume) fscache_cookie_state_machine cachefiles_withdraw_cookie cache = objeto-\u0026gt;volumen-\u0026gt;cache; // archivos_cach\u00e9_volumen UAF !!! Despu\u00e9s de configurar FSCACHE_CACHE_IS_WITHDRAWN, primero espere a que se completen todas las b\u00fasquedas de cookies y luego espere a que fscache_cache-\u0026gt;object_count == 0 para evitar que la cookie salga despu\u00e9s de que se haya liberado el volumen y desencadene el problema anterior. Por lo tanto, llame a fscache_withdraw_volume() antes de llamar a cachefiles_withdraw_objects(). De esta manera, despu\u00e9s de configurar FSCACHE_CACHE_IS_WITHDRAWN, solo ocurrir\u00e1n los dos casos siguientes: 1) fscache_begin_lookup falla en fscache_begin_volume_access(). 2) fscache_withdraw_volume() garantizar\u00e1 que fscache_count_object() se haya ejecutado antes de llamar a fscache_wait_for_objects().\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/cachefiles/cache.c\",\"fs/cachefiles/volume.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"fe2140e2f57fef8562e0f9b7cd447d2b08dc2f35\",\"lessThan\":\"8de253177112a47c9af157d23ae934779188b4e1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fe2140e2f57fef8562e0f9b7cd447d2b08dc2f35\",\"lessThan\":\"9e67589a4a7b7e5660b524d1d5fe61242bcbcc11\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fe2140e2f57fef8562e0f9b7cd447d2b08dc2f35\",\"lessThan\":\"ef81340401e8a371d6b17f69e76d861920972cfe\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fe2140e2f57fef8562e0f9b7cd447d2b08dc2f35\",\"lessThan\":\"5d8f805789072ea7fd39504694b7bd17e5f751c4\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/cachefiles/cache.c\",\"fs/cachefiles/volume.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.17\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.17\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.101\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.42\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9.11\",\"lessThanOrEqual\":\"6.9.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.0,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T16:22:21.821093Z\",\"id\":\"CVE-2024-41057\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.17\",\"versionEndExcluding\":\"6.1.101\",\"matchCriteriaId\":\"DB356B3F-4040-49B4-8BB9-E2643A2E9B13\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.42\",\"matchCriteriaId\":\"972274A2-D688-4C37-BE42-689B58B4C225\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.9.11\",\"matchCriteriaId\":\"01E300B3-8B39-4A2D-8B03-4631433D3915\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/5d8f805789072ea7fd39504694b7bd17e5f751c4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8de253177112a47c9af157d23ae934779188b4e1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9e67589a4a7b7e5660b524d1d5fe61242bcbcc11\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ef81340401e8a371d6b17f69e76d861920972cfe\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5d8f805789072ea7fd39504694b7bd17e5f751c4\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8de253177112a47c9af157d23ae934779188b4e1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9e67589a4a7b7e5660b524d1d5fe61242bcbcc11\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ef81340401e8a371d6b17f69e76d861920972cfe\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-08-04T18:43:14+00:00",
"cve": "CVE-2024-41057",
"id": "CVE-2024-41057",
"initial_release_date": "2024-07-29T00:00:00+00:00",
"product_status:fixed": "280",
"product_status:known_affected": "64",
"product_status:known_not_affected": "56",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: cachefiles: fix slab-use-after-free in cachefiles_withdraw_cookie()",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-41057.json",
"version": "3"
},
"suse_vex": {
"aggregate_severity": "important",
"current_release_date": "2026-09-01T01:10:14Z",
"cve": "CVE-2024-41057",
"id": "CVE-2024-41057",
"initial_release_date": "2024-08-06T02:01:38Z",
"product_status:known_affected": "330",
"product_status:known_not_affected": "285",
"product_status:recommended": "677",
"source": "SUSE CSAF VEX",
"status": "interim",
"title": "SUSE CVE CVE-2024-41057",
"url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-41057.json",
"version": "74"
},
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/8de253177112a47c9af157d23ae934779188b4e1\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/9e67589a4a7b7e5660b524d1d5fe61242bcbcc11\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/ef81340401e8a371d6b17f69e76d861920972cfe\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/5d8f805789072ea7fd39504694b7bd17e5f751c4\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T04:46:51.624Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-41057\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T16:22:21.821093Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:13.748Z\"}}], \"cna\": {\"title\": \"cachefiles: fix slab-use-after-free in cachefiles_withdraw_cookie()\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"fe2140e2f57f\", \"lessThan\": \"8de253177112\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"fe2140e2f57f\", \"lessThan\": \"9e67589a4a7b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"fe2140e2f57f\", \"lessThan\": \"ef81340401e8\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"fe2140e2f57f\", \"lessThan\": \"5d8f80578907\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/cachefiles/cache.c\", \"fs/cachefiles/volume.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.17\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.17\", \"versionType\": \"custom\"}, {\"status\": \"unaffected\", \"version\": \"6.1.101\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.42\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9.11\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/cachefiles/cache.c\", \"fs/cachefiles/volume.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/8de253177112a47c9af157d23ae934779188b4e1\"}, {\"url\": \"https://git.kernel.org/stable/c/9e67589a4a7b7e5660b524d1d5fe61242bcbcc11\"}, {\"url\": \"https://git.kernel.org/stable/c/ef81340401e8a371d6b17f69e76d861920972cfe\"}, {\"url\": \"https://git.kernel.org/stable/c/5d8f805789072ea7fd39504694b7bd17e5f751c4\"}], \"x_generator\": {\"engine\": \"bippy-c9c4e1df01b2\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncachefiles: fix slab-use-after-free in cachefiles_withdraw_cookie()\\n\\nWe got the following issue in our fault injection stress test:\\n\\n==================================================================\\nBUG: KASAN: slab-use-after-free in cachefiles_withdraw_cookie+0x4d9/0x600\\nRead of size 8 at addr ffff888118efc000 by task kworker/u78:0/109\\n\\nCPU: 13 PID: 109 Comm: kworker/u78:0 Not tainted 6.8.0-dirty #566\\nCall Trace:\\n \u003cTASK\u003e\\n kasan_report+0x93/0xc0\\n cachefiles_withdraw_cookie+0x4d9/0x600\\n fscache_cookie_state_machine+0x5c8/0x1230\\n fscache_cookie_worker+0x91/0x1c0\\n process_one_work+0x7fa/0x1800\\n [...]\\n\\nAllocated by task 117:\\n kmalloc_trace+0x1b3/0x3c0\\n cachefiles_acquire_volume+0xf3/0x9c0\\n fscache_create_volume_work+0x97/0x150\\n process_one_work+0x7fa/0x1800\\n [...]\\n\\nFreed by task 120301:\\n kfree+0xf1/0x2c0\\n cachefiles_withdraw_cache+0x3fa/0x920\\n cachefiles_put_unbind_pincount+0x1f6/0x250\\n cachefiles_daemon_release+0x13b/0x290\\n __fput+0x204/0xa00\\n task_work_run+0x139/0x230\\n do_exit+0x87a/0x29b0\\n [...]\\n==================================================================\\n\\nFollowing is the process that triggers the issue:\\n\\n p1 | p2\\n------------------------------------------------------------\\n fscache_begin_lookup\\n fscache_begin_volume_access\\n fscache_cache_is_live(fscache_cache)\\ncachefiles_daemon_release\\n cachefiles_put_unbind_pincount\\n cachefiles_daemon_unbind\\n cachefiles_withdraw_cache\\n fscache_withdraw_cache\\n fscache_set_cache_state(cache, FSCACHE_CACHE_IS_WITHDRAWN);\\n cachefiles_withdraw_objects(cache)\\n fscache_wait_for_objects(fscache)\\n atomic_read(\u0026fscache_cache-\u003eobject_count) == 0\\n fscache_perform_lookup\\n cachefiles_lookup_cookie\\n cachefiles_alloc_object\\n refcount_set(\u0026object-\u003eref, 1);\\n object-\u003evolume = volume\\n fscache_count_object(vcookie-\u003ecache);\\n atomic_inc(\u0026fscache_cache-\u003eobject_count)\\n cachefiles_withdraw_volumes\\n cachefiles_withdraw_volume\\n fscache_withdraw_volume\\n __cachefiles_free_volume\\n kfree(cachefiles_volume)\\n fscache_cookie_state_machine\\n cachefiles_withdraw_cookie\\n cache = object-\u003evolume-\u003ecache;\\n // cachefiles_volume UAF !!!\\n\\nAfter setting FSCACHE_CACHE_IS_WITHDRAWN, wait for all the cookie lookups\\nto complete first, and then wait for fscache_cache-\u003eobject_count == 0 to\\navoid the cookie exiting after the volume has been freed and triggering\\nthe above issue. Therefore call fscache_withdraw_volume() before calling\\ncachefiles_withdraw_objects().\\n\\nThis way, after setting FSCACHE_CACHE_IS_WITHDRAWN, only the following two\\ncases will occur:\\n1) fscache_begin_lookup fails in fscache_begin_volume_access().\\n2) fscache_withdraw_volume() will ensure that fscache_count_object() has\\n been executed before calling fscache_wait_for_objects().\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-07-29T14:57:19.938Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2024-41057\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-09-11T17:32:57.641Z\", \"dateReserved\": \"2024-07-12T12:17:45.627Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-07-29T14:57:19.938Z\", \"assignerShortName\": \"Linux\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…