GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-45000 (GCVE-0-2024-45000)

Vulnerability from cvelistv5 – Published: 2024-09-04 19:54 – Updated: 2026-08-05 11:37
VLAI
Title
fs/netfs/fscache_cookie: add missing "n_accesses" check
Summary
In the Linux kernel, the following vulnerability has been resolved: fs/netfs/fscache_cookie: add missing "n_accesses" check This fixes a NULL pointer dereference bug due to a data race which looks like this: BUG: kernel NULL pointer dereference, address: 0000000000000008 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] SMP PTI CPU: 33 PID: 16573 Comm: kworker/u97:799 Not tainted 6.8.7-cm4all1-hp+ #43 Hardware name: HP ProLiant DL380 Gen9/ProLiant DL380 Gen9, BIOS P89 10/17/2018 Workqueue: events_unbound netfs_rreq_write_to_cache_work RIP: 0010:cachefiles_prepare_write+0x30/0xa0 Code: 57 41 56 45 89 ce 41 55 49 89 cd 41 54 49 89 d4 55 53 48 89 fb 48 83 ec 08 48 8b 47 08 48 83 7f 10 00 48 89 34 24 48 8b 68 20 <48> 8b 45 08 4c 8b 38 74 45 49 8b 7f 50 e8 4e a9 b0 ff 48 8b 73 10 RSP: 0018:ffffb4e78113bde0 EFLAGS: 00010286 RAX: ffff976126be6d10 RBX: ffff97615cdb8438 RCX: 0000000000020000 RDX: ffff97605e6c4c68 RSI: ffff97605e6c4c60 RDI: ffff97615cdb8438 RBP: 0000000000000000 R08: 0000000000278333 R09: 0000000000000001 R10: ffff97605e6c4600 R11: 0000000000000001 R12: ffff97605e6c4c68 R13: 0000000000020000 R14: 0000000000000001 R15: ffff976064fe2c00 FS: 0000000000000000(0000) GS:ffff9776dfd40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000008 CR3: 000000005942c002 CR4: 00000000001706f0 Call Trace: <TASK> ? __die+0x1f/0x70 ? page_fault_oops+0x15d/0x440 ? search_module_extables+0xe/0x40 ? fixup_exception+0x22/0x2f0 ? exc_page_fault+0x5f/0x100 ? asm_exc_page_fault+0x22/0x30 ? cachefiles_prepare_write+0x30/0xa0 netfs_rreq_write_to_cache_work+0x135/0x2e0 process_one_work+0x137/0x2c0 worker_thread+0x2e9/0x400 ? __pfx_worker_thread+0x10/0x10 kthread+0xcc/0x100 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x30/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 </TASK> Modules linked in: CR2: 0000000000000008 ---[ end trace 0000000000000000 ]--- This happened because fscache_cookie_state_machine() was slow and was still running while another process invoked fscache_unuse_cookie(); this led to a fscache_cookie_lru_do_one() call, setting the FSCACHE_COOKIE_DO_LRU_DISCARD flag, which was picked up by fscache_cookie_state_machine(), withdrawing the cookie via cachefiles_withdraw_cookie(), clearing cookie->cache_priv. At the same time, yet another process invoked cachefiles_prepare_write(), which found a NULL pointer in this code line: struct cachefiles_object *object = cachefiles_cres_object(cres); The next line crashes, obviously: struct cachefiles_cache *cache = object->volume->cache; During cachefiles_prepare_write(), the "n_accesses" counter is non-zero (via fscache_begin_operation()). The cookie must not be withdrawn until it drops to zero. The counter is checked by fscache_cookie_state_machine() before switching to FSCACHE_COOKIE_STATE_RELINQUISHING and FSCACHE_COOKIE_STATE_WITHDRAWING (in "case FSCACHE_COOKIE_STATE_FAILED"), but not for FSCACHE_COOKIE_STATE_LRU_DISCARDING ("case FSCACHE_COOKIE_STATE_ACTIVE"). This patch adds the missing check. With a non-zero access counter, the function returns and the next fscache_end_cookie_access() call will queue another fscache_cookie_state_machine() call to handle the still-pending FSCACHE_COOKIE_DO_LRU_DISCARD.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-04 20:18 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 12bb21a29c19aae50cfad4e2bb5c943108f34a7d , < b8a50877f68efdcc0be3fcc5116e00c31b90e45b (git)
Affected: 12bb21a29c19aae50cfad4e2bb5c943108f34a7d , < dfaa39b05a6cf34a16c525a2759ee6ab26b5fef6 (git)
Affected: 12bb21a29c19aae50cfad4e2bb5c943108f34a7d , < 0a4d41fa14b2a0efd40e350cfe8ec6a4c998ac1d (git)
Affected: 12bb21a29c19aae50cfad4e2bb5c943108f34a7d , < f71aa06398aabc2e3eaac25acdf3d62e0094ba70 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.17
Unaffected: 0 , < 5.17 (semver)
Unaffected: 6.1.107 , ≤ 6.1.* (semver)
Unaffected: 6.6.48 , ≤ 6.6.* (semver)
Unaffected: 6.10.7 , ≤ 6.10.* (semver)
Unaffected: 6.11 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-45000",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-04T20:18:51.783797Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-04T20:19:07.787Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:14:58.570Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/netfs/fscache_cookie.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b8a50877f68efdcc0be3fcc5116e00c31b90e45b",
              "status": "affected",
              "version": "12bb21a29c19aae50cfad4e2bb5c943108f34a7d",
              "versionType": "git"
            },
            {
              "lessThan": "dfaa39b05a6cf34a16c525a2759ee6ab26b5fef6",
              "status": "affected",
              "version": "12bb21a29c19aae50cfad4e2bb5c943108f34a7d",
              "versionType": "git"
            },
            {
              "lessThan": "0a4d41fa14b2a0efd40e350cfe8ec6a4c998ac1d",
              "status": "affected",
              "version": "12bb21a29c19aae50cfad4e2bb5c943108f34a7d",
              "versionType": "git"
            },
            {
              "lessThan": "f71aa06398aabc2e3eaac25acdf3d62e0094ba70",
              "status": "affected",
              "version": "12bb21a29c19aae50cfad4e2bb5c943108f34a7d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/netfs/fscache_cookie.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "lessThan": "5.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.107",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.48",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.107",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.48",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.7",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/netfs/fscache_cookie: add missing \"n_accesses\" check\n\nThis fixes a NULL pointer dereference bug due to a data race which\nlooks like this:\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000008\n  #PF: supervisor read access in kernel mode\n  #PF: error_code(0x0000) - not-present page\n  PGD 0 P4D 0\n  Oops: 0000 [#1] SMP PTI\n  CPU: 33 PID: 16573 Comm: kworker/u97:799 Not tainted 6.8.7-cm4all1-hp+ #43\n  Hardware name: HP ProLiant DL380 Gen9/ProLiant DL380 Gen9, BIOS P89 10/17/2018\n  Workqueue: events_unbound netfs_rreq_write_to_cache_work\n  RIP: 0010:cachefiles_prepare_write+0x30/0xa0\n  Code: 57 41 56 45 89 ce 41 55 49 89 cd 41 54 49 89 d4 55 53 48 89 fb 48 83 ec 08 48 8b 47 08 48 83 7f 10 00 48 89 34 24 48 8b 68 20 \u003c48\u003e 8b 45 08 4c 8b 38 74 45 49 8b 7f 50 e8 4e a9 b0 ff 48 8b 73 10\n  RSP: 0018:ffffb4e78113bde0 EFLAGS: 00010286\n  RAX: ffff976126be6d10 RBX: ffff97615cdb8438 RCX: 0000000000020000\n  RDX: ffff97605e6c4c68 RSI: ffff97605e6c4c60 RDI: ffff97615cdb8438\n  RBP: 0000000000000000 R08: 0000000000278333 R09: 0000000000000001\n  R10: ffff97605e6c4600 R11: 0000000000000001 R12: ffff97605e6c4c68\n  R13: 0000000000020000 R14: 0000000000000001 R15: ffff976064fe2c00\n  FS:  0000000000000000(0000) GS:ffff9776dfd40000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 0000000000000008 CR3: 000000005942c002 CR4: 00000000001706f0\n  Call Trace:\n   \u003cTASK\u003e\n   ? __die+0x1f/0x70\n   ? page_fault_oops+0x15d/0x440\n   ? search_module_extables+0xe/0x40\n   ? fixup_exception+0x22/0x2f0\n   ? exc_page_fault+0x5f/0x100\n   ? asm_exc_page_fault+0x22/0x30\n   ? cachefiles_prepare_write+0x30/0xa0\n   netfs_rreq_write_to_cache_work+0x135/0x2e0\n   process_one_work+0x137/0x2c0\n   worker_thread+0x2e9/0x400\n   ? __pfx_worker_thread+0x10/0x10\n   kthread+0xcc/0x100\n   ? __pfx_kthread+0x10/0x10\n   ret_from_fork+0x30/0x50\n   ? __pfx_kthread+0x10/0x10\n   ret_from_fork_asm+0x1b/0x30\n   \u003c/TASK\u003e\n  Modules linked in:\n  CR2: 0000000000000008\n  ---[ end trace 0000000000000000 ]---\n\nThis happened because fscache_cookie_state_machine() was slow and was\nstill running while another process invoked fscache_unuse_cookie();\nthis led to a fscache_cookie_lru_do_one() call, setting the\nFSCACHE_COOKIE_DO_LRU_DISCARD flag, which was picked up by\nfscache_cookie_state_machine(), withdrawing the cookie via\ncachefiles_withdraw_cookie(), clearing cookie-\u003ecache_priv.\n\nAt the same time, yet another process invoked\ncachefiles_prepare_write(), which found a NULL pointer in this code\nline:\n\n  struct cachefiles_object *object = cachefiles_cres_object(cres);\n\nThe next line crashes, obviously:\n\n  struct cachefiles_cache *cache = object-\u003evolume-\u003ecache;\n\nDuring cachefiles_prepare_write(), the \"n_accesses\" counter is\nnon-zero (via fscache_begin_operation()).  The cookie must not be\nwithdrawn until it drops to zero.\n\nThe counter is checked by fscache_cookie_state_machine() before\nswitching to FSCACHE_COOKIE_STATE_RELINQUISHING and\nFSCACHE_COOKIE_STATE_WITHDRAWING (in \"case\nFSCACHE_COOKIE_STATE_FAILED\"), but not for\nFSCACHE_COOKIE_STATE_LRU_DISCARDING (\"case\nFSCACHE_COOKIE_STATE_ACTIVE\").\n\nThis patch adds the missing check.  With a non-zero access counter,\nthe function returns and the next fscache_end_cookie_access() call\nwill queue another fscache_cookie_state_machine() call to handle the\nstill-pending FSCACHE_COOKIE_DO_LRU_DISCARD."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached through ordinary file I/O (open/read/close) on a locally mounted fscache-backed network filesystem or erofs-over-fscache image; no network packet processing initiates the operation, only local VFS activity does.\nAC:L - The attacker controls both sides of the race \u2014 the in-flight write-to-cache operation that holds n_accesses, and the close that puts the cookie on the LRU with a deterministic 10-second (10*HZ) discard timer \u2014 and can run it across thousands of files concurrently to widen the window and retry indefinitely.\nPR:L - Only an unprivileged local user with read access to files on the cached mount is required; no capability, no cachefilesd interaction, and no CAP_SYS_ADMIN is needed to drive cookie use/unuse and cache writeback.\nUI:N - No victim action is needed during the attack \u2014 the fsc-enabled mount is a pre-existing system configuration, and the attacker triggers everything itself via its own file I/O.\nS:U - The corruption and its consequences stay within the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Premature withdrawal frees the cachefiles_object via kmem_cache_free with no RCU delay while cachefiles_prepare_write still dereferences it, so pointers (object-\u003evolume, -\u003ecache, -\u003ecookie, -\u003efile) are read out of reclaimable slab memory, giving an attacker-groomable arbitrary-read primitive.\nI:H - The same use-after-free feeds a freed/reclaimed pointer into cachefiles_begin_secure() \u2192 override_creds(cache-\u003ecache_cred) and into refcount_inc via cachefiles_grab_object, plus writes through object-\u003efile in __cachefiles_prepare_write \u2014 a credential-substitution and write primitive exploitable for privilege escalation.\nA:H - The reported and easily reproduced outcome is a kernel NULL pointer dereference oops in the events_unbound worker (cachefiles_prepare_write+0x30), killing the workqueue thread and destabilizing the system; UAF outcomes crash equally."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:37:37.373Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b8a50877f68efdcc0be3fcc5116e00c31b90e45b"
        },
        {
          "url": "https://git.kernel.org/stable/c/dfaa39b05a6cf34a16c525a2759ee6ab26b5fef6"
        },
        {
          "url": "https://git.kernel.org/stable/c/0a4d41fa14b2a0efd40e350cfe8ec6a4c998ac1d"
        },
        {
          "url": "https://git.kernel.org/stable/c/f71aa06398aabc2e3eaac25acdf3d62e0094ba70"
        }
      ],
      "title": "fs/netfs/fscache_cookie: add missing \"n_accesses\" check",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-45000",
    "datePublished": "2024-09-04T19:54:44.273Z",
    "dateReserved": "2024-08-21T05:34:56.677Z",
    "dateUpdated": "2026-08-05T11:37:37.373Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-45000",
      "date": "2026-09-16",
      "epss": "0.00233",
      "percentile": "0.1437"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.17\", \"versionEndExcluding\": \"6.1.107\", \"matchCriteriaId\": \"E1FCBB3B-3EA3-4D99-B4C1-E8EA9F3DA097\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.2\", \"versionEndExcluding\": \"6.6.48\", \"matchCriteriaId\": \"9DE9201A-CE6B-4726-BABB-8265EA0F8AE4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.10.7\", \"matchCriteriaId\": \"D2AFDFD1-D95A-4EB7-843B-5E7659518B67\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"8B3CE743-2126-47A3-8B7C-822B502CF119\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"4DEB27E7-30AA-45CC-8934-B89263EF3551\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"E0005AEF-856E-47EB-BFE4-90C46899394D\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nfs/netfs/fscache_cookie: add missing \\\"n_accesses\\\" check\\n\\nThis fixes a NULL pointer dereference bug due to a data race which\\nlooks like this:\\n\\n  BUG: kernel NULL pointer dereference, address: 0000000000000008\\n  #PF: supervisor read access in kernel mode\\n  #PF: error_code(0x0000) - not-present page\\n  PGD 0 P4D 0\\n  Oops: 0000 [#1] SMP PTI\\n  CPU: 33 PID: 16573 Comm: kworker/u97:799 Not tainted 6.8.7-cm4all1-hp+ #43\\n  Hardware name: HP ProLiant DL380 Gen9/ProLiant DL380 Gen9, BIOS P89 10/17/2018\\n  Workqueue: events_unbound netfs_rreq_write_to_cache_work\\n  RIP: 0010:cachefiles_prepare_write+0x30/0xa0\\n  Code: 57 41 56 45 89 ce 41 55 49 89 cd 41 54 49 89 d4 55 53 48 89 fb 48 83 ec 08 48 8b 47 08 48 83 7f 10 00 48 89 34 24 48 8b 68 20 \u003c48\u003e 8b 45 08 4c 8b 38 74 45 49 8b 7f 50 e8 4e a9 b0 ff 48 8b 73 10\\n  RSP: 0018:ffffb4e78113bde0 EFLAGS: 00010286\\n  RAX: ffff976126be6d10 RBX: ffff97615cdb8438 RCX: 0000000000020000\\n  RDX: ffff97605e6c4c68 RSI: ffff97605e6c4c60 RDI: ffff97615cdb8438\\n  RBP: 0000000000000000 R08: 0000000000278333 R09: 0000000000000001\\n  R10: ffff97605e6c4600 R11: 0000000000000001 R12: ffff97605e6c4c68\\n  R13: 0000000000020000 R14: 0000000000000001 R15: ffff976064fe2c00\\n  FS:  0000000000000000(0000) GS:ffff9776dfd40000(0000) knlGS:0000000000000000\\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n  CR2: 0000000000000008 CR3: 000000005942c002 CR4: 00000000001706f0\\n  Call Trace:\\n   \u003cTASK\u003e\\n   ? __die+0x1f/0x70\\n   ? page_fault_oops+0x15d/0x440\\n   ? search_module_extables+0xe/0x40\\n   ? fixup_exception+0x22/0x2f0\\n   ? exc_page_fault+0x5f/0x100\\n   ? asm_exc_page_fault+0x22/0x30\\n   ? cachefiles_prepare_write+0x30/0xa0\\n   netfs_rreq_write_to_cache_work+0x135/0x2e0\\n   process_one_work+0x137/0x2c0\\n   worker_thread+0x2e9/0x400\\n   ? __pfx_worker_thread+0x10/0x10\\n   kthread+0xcc/0x100\\n   ? __pfx_kthread+0x10/0x10\\n   ret_from_fork+0x30/0x50\\n   ? __pfx_kthread+0x10/0x10\\n   ret_from_fork_asm+0x1b/0x30\\n   \u003c/TASK\u003e\\n  Modules linked in:\\n  CR2: 0000000000000008\\n  ---[ end trace 0000000000000000 ]---\\n\\nThis happened because fscache_cookie_state_machine() was slow and was\\nstill running while another process invoked fscache_unuse_cookie();\\nthis led to a fscache_cookie_lru_do_one() call, setting the\\nFSCACHE_COOKIE_DO_LRU_DISCARD flag, which was picked up by\\nfscache_cookie_state_machine(), withdrawing the cookie via\\ncachefiles_withdraw_cookie(), clearing cookie-\u003ecache_priv.\\n\\nAt the same time, yet another process invoked\\ncachefiles_prepare_write(), which found a NULL pointer in this code\\nline:\\n\\n  struct cachefiles_object *object = cachefiles_cres_object(cres);\\n\\nThe next line crashes, obviously:\\n\\n  struct cachefiles_cache *cache = object-\u003evolume-\u003ecache;\\n\\nDuring cachefiles_prepare_write(), the \\\"n_accesses\\\" counter is\\nnon-zero (via fscache_begin_operation()).  The cookie must not be\\nwithdrawn until it drops to zero.\\n\\nThe counter is checked by fscache_cookie_state_machine() before\\nswitching to FSCACHE_COOKIE_STATE_RELINQUISHING and\\nFSCACHE_COOKIE_STATE_WITHDRAWING (in \\\"case\\nFSCACHE_COOKIE_STATE_FAILED\\\"), but not for\\nFSCACHE_COOKIE_STATE_LRU_DISCARDING (\\\"case\\nFSCACHE_COOKIE_STATE_ACTIVE\\\").\\n\\nThis patch adds the missing check.  With a non-zero access counter,\\nthe function returns and the next fscache_end_cookie_access() call\\nwill queue another fscache_cookie_state_machine() call to handle the\\nstill-pending FSCACHE_COOKIE_DO_LRU_DISCARD.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: fs/netfs/fscache_cookie: agregar comprobaci\\u00f3n \\\"n_accesses\\\" faltante Esto corrige un error de desreferencia de puntero NULL debido a una ejecuci\\u00f3n de datos que se ve as\\u00ed: ERROR: desreferencia de puntero NULL del kernel, direcci\\u00f3n: 0000000000000008 #PF: acceso de lectura de supervisor en modo kernel #PF: error_code(0x0000) - p\\u00e1gina no presente PGD 0 P4D 0 Oops: 0000 [#1] SMP PTI CPU: 33 PID: 16573 Comm: kworker/u97:799 No contaminado 6.8.7-cm4all1-hp+ #43 Nombre del hardware: HP ProLiant DL380 Gen9/ProLiant DL380 Gen9, BIOS P89 17/10/2018 Cola de trabajo: events_unbound netfs_rreq_write_to_cache_work RIP: 0010:cachefiles_prepare_write+0x30/0xa0 C\\u00f3digo: 57 41 56 45 89 ce 41 55 49 89 cd 41 54 49 89 d4 55 53 48 89 fb 48 83 ec 08 48 8b 47 08 48 83 7f 10 00 48 89 34 24 48 8b 68 20 \u0026lt;48\u0026gt; 8b 45 08 4c 8b 38 74 45 49 8b 7f 50 e8 4e a9 b0 ff 48 8b 73 10 RSP: 0018:ffffb4e78113bde0 EFLAGS: 00010286 RAX: ffff976126be6d10 RBX: ffff97615cdb8438 RCX: 0000000000020000 RDX: ffff97605e6c4c68 RSI: ffff97605e6c4c60 RDI: ffff97615cdb8438 RBP: 000000000000000 R08: 0000000000278333 R09: 0000000000000001 R10: ffff97605e6c4600 R11: 0000000000000001 R12: ffff97605e6c4c68 R13: 0000000000020000 R14: 0000000000000001 R15: ffff976064fe2c00 FS: 000000000000000(0000) GS:ffff9776dfd40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000000008 CR3: 000000005942c002 CR4: 00000000001706f0 Seguimiento de llamadas:  ? __die+0x1f/0x70 ? page_fault_oops+0x15d/0x440 ? search_module_extables+0xe/0x40 ? fixup_exception+0x22/0x2f0 ? exc_page_fault+0x5f/0x100 ? asm_exc_page_fault+0x22/0x30 ? cachefiles_prepare_write+0x30/0xa0 netfs_rreq_write_to_cache_work+0x135/0x2e0 process_one_work+0x137/0x2c0 subproceso_trabajador+0x2e9/0x400 ? __pfx_worker_thread+0x10/0x10 kthread+0xcc/0x100 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x30/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30  M\\u00f3dulos vinculados en: CR2: 000000000000008 ---[ fin del seguimiento 000000000000000 ]--- Esto sucedi\\u00f3 porque fscache_cookie_state_machine() era lento y todav\\u00eda se estaba ejecutando mientras otro proceso invocaba fscache_unuse_cookie(); Esto llev\\u00f3 a una llamada a fscache_cookie_lru_do_one(), que estableci\\u00f3 el indicador FSCACHE_COOKIE_DO_LRU_DISCARD, que fue detectado por fscache_cookie_state_machine(), retirando la cookie a trav\\u00e9s de cachefiles_withdraw_cookie(), borrando cookie-\u0026gt;cache_priv. Al mismo tiempo, otro proceso invoc\\u00f3 cachefiles_prepare_write(), que encontr\\u00f3 un puntero NULL en esta l\\u00ednea de c\\u00f3digo: struct cachefiles_object *object = cachefiles_cres_object(cres); La siguiente l\\u00ednea falla, obviamente: struct cachefiles_cache *cache = object-\u0026gt;volume-\u0026gt;cache; Durante cachefiles_prepare_write(), el contador \\\"n_accesses\\\" no es cero (a trav\\u00e9s de fscache_begin_operation()). La cookie no debe retirarse hasta que baje a cero. El contador se comprueba mediante fscache_cookie_state_machine() antes de cambiar a FSCACHE_COOKIE_STATE_RELINQUISHING y FSCACHE_COOKIE_STATE_WITHDRAWING (en el \\\"caso FSCACHE_COOKIE_STATE_FAILED\\\"), pero no para FSCACHE_COOKIE_STATE_LRU_DISCARDING (\\\"caso FSCACHE_COOKIE_STATE_ACTIVE\\\"). Este parche agrega la comprobaci\\u00f3n faltante. Con un contador de acceso distinto de cero, la funci\\u00f3n retorna y la siguiente llamada fscache_end_cookie_access() pondr\\u00e1 en cola otra llamada fscache_cookie_state_machine() para manejar la FSCACHE_COOKIE_DO_LRU_DISCARD a\\u00fan pendiente.\"}]",
      "id": "CVE-2024-45000",
      "lastModified": "2024-09-06T16:27:31.003",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-09-04T20:15:08.657",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/0a4d41fa14b2a0efd40e350cfe8ec6a4c998ac1d\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/b8a50877f68efdcc0be3fcc5116e00c31b90e45b\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/dfaa39b05a6cf34a16c525a2759ee6ab26b5fef6\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/f71aa06398aabc2e3eaac25acdf3d62e0094ba70\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-476\"}]}]"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T01:29:03.000Z",
      "cve": "CVE-2024-45000",
      "id": "msrc_CVE-2024-45000",
      "initial_release_date": "2024-09-01T07:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "fs/netfs/fscache_cookie: add missing \"n_accesses\" check",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-45000.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-45000\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-09-04T20:15:08.657\",\"lastModified\":\"2026-08-04T11:20:09.243\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nfs/netfs/fscache_cookie: add missing \\\"n_accesses\\\" check\\n\\nThis fixes a NULL pointer dereference bug due to a data race which\\nlooks like this:\\n\\n  BUG: kernel NULL pointer dereference, address: 0000000000000008\\n  #PF: supervisor read access in kernel mode\\n  #PF: error_code(0x0000) - not-present page\\n  PGD 0 P4D 0\\n  Oops: 0000 [#1] SMP PTI\\n  CPU: 33 PID: 16573 Comm: kworker/u97:799 Not tainted 6.8.7-cm4all1-hp+ #43\\n  Hardware name: HP ProLiant DL380 Gen9/ProLiant DL380 Gen9, BIOS P89 10/17/2018\\n  Workqueue: events_unbound netfs_rreq_write_to_cache_work\\n  RIP: 0010:cachefiles_prepare_write+0x30/0xa0\\n  Code: 57 41 56 45 89 ce 41 55 49 89 cd 41 54 49 89 d4 55 53 48 89 fb 48 83 ec 08 48 8b 47 08 48 83 7f 10 00 48 89 34 24 48 8b 68 20 \u003c48\u003e 8b 45 08 4c 8b 38 74 45 49 8b 7f 50 e8 4e a9 b0 ff 48 8b 73 10\\n  RSP: 0018:ffffb4e78113bde0 EFLAGS: 00010286\\n  RAX: ffff976126be6d10 RBX: ffff97615cdb8438 RCX: 0000000000020000\\n  RDX: ffff97605e6c4c68 RSI: ffff97605e6c4c60 RDI: ffff97615cdb8438\\n  RBP: 0000000000000000 R08: 0000000000278333 R09: 0000000000000001\\n  R10: ffff97605e6c4600 R11: 0000000000000001 R12: ffff97605e6c4c68\\n  R13: 0000000000020000 R14: 0000000000000001 R15: ffff976064fe2c00\\n  FS:  0000000000000000(0000) GS:ffff9776dfd40000(0000) knlGS:0000000000000000\\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n  CR2: 0000000000000008 CR3: 000000005942c002 CR4: 00000000001706f0\\n  Call Trace:\\n   \u003cTASK\u003e\\n   ? __die+0x1f/0x70\\n   ? page_fault_oops+0x15d/0x440\\n   ? search_module_extables+0xe/0x40\\n   ? fixup_exception+0x22/0x2f0\\n   ? exc_page_fault+0x5f/0x100\\n   ? asm_exc_page_fault+0x22/0x30\\n   ? cachefiles_prepare_write+0x30/0xa0\\n   netfs_rreq_write_to_cache_work+0x135/0x2e0\\n   process_one_work+0x137/0x2c0\\n   worker_thread+0x2e9/0x400\\n   ? __pfx_worker_thread+0x10/0x10\\n   kthread+0xcc/0x100\\n   ? __pfx_kthread+0x10/0x10\\n   ret_from_fork+0x30/0x50\\n   ? __pfx_kthread+0x10/0x10\\n   ret_from_fork_asm+0x1b/0x30\\n   \u003c/TASK\u003e\\n  Modules linked in:\\n  CR2: 0000000000000008\\n  ---[ end trace 0000000000000000 ]---\\n\\nThis happened because fscache_cookie_state_machine() was slow and was\\nstill running while another process invoked fscache_unuse_cookie();\\nthis led to a fscache_cookie_lru_do_one() call, setting the\\nFSCACHE_COOKIE_DO_LRU_DISCARD flag, which was picked up by\\nfscache_cookie_state_machine(), withdrawing the cookie via\\ncachefiles_withdraw_cookie(), clearing cookie-\u003ecache_priv.\\n\\nAt the same time, yet another process invoked\\ncachefiles_prepare_write(), which found a NULL pointer in this code\\nline:\\n\\n  struct cachefiles_object *object = cachefiles_cres_object(cres);\\n\\nThe next line crashes, obviously:\\n\\n  struct cachefiles_cache *cache = object-\u003evolume-\u003ecache;\\n\\nDuring cachefiles_prepare_write(), the \\\"n_accesses\\\" counter is\\nnon-zero (via fscache_begin_operation()).  The cookie must not be\\nwithdrawn until it drops to zero.\\n\\nThe counter is checked by fscache_cookie_state_machine() before\\nswitching to FSCACHE_COOKIE_STATE_RELINQUISHING and\\nFSCACHE_COOKIE_STATE_WITHDRAWING (in \\\"case\\nFSCACHE_COOKIE_STATE_FAILED\\\"), but not for\\nFSCACHE_COOKIE_STATE_LRU_DISCARDING (\\\"case\\nFSCACHE_COOKIE_STATE_ACTIVE\\\").\\n\\nThis patch adds the missing check.  With a non-zero access counter,\\nthe function returns and the next fscache_end_cookie_access() call\\nwill queue another fscache_cookie_state_machine() call to handle the\\nstill-pending FSCACHE_COOKIE_DO_LRU_DISCARD.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: fs/netfs/fscache_cookie: agregar comprobaci\u00f3n \\\"n_accesses\\\" faltante Esto corrige un error de desreferencia de puntero NULL debido a una ejecuci\u00f3n de datos que se ve as\u00ed: ERROR: desreferencia de puntero NULL del kernel, direcci\u00f3n: 0000000000000008 #PF: acceso de lectura de supervisor en modo kernel #PF: error_code(0x0000) - p\u00e1gina no presente PGD 0 P4D 0 Oops: 0000 [#1] SMP PTI CPU: 33 PID: 16573 Comm: kworker/u97:799 No contaminado 6.8.7-cm4all1-hp+ #43 Nombre del hardware: HP ProLiant DL380 Gen9/ProLiant DL380 Gen9, BIOS P89 17/10/2018 Cola de trabajo: events_unbound netfs_rreq_write_to_cache_work RIP: 0010:cachefiles_prepare_write+0x30/0xa0 C\u00f3digo: 57 41 56 45 89 ce 41 55 49 89 cd 41 54 49 89 d4 55 53 48 89 fb 48 83 ec 08 48 8b 47 08 48 83 7f 10 00 48 89 34 24 48 8b 68 20 \u0026lt;48\u0026gt; 8b 45 08 4c 8b 38 74 45 49 8b 7f 50 e8 4e a9 b0 ff 48 8b 73 10 RSP: 0018:ffffb4e78113bde0 EFLAGS: 00010286 RAX: ffff976126be6d10 RBX: ffff97615cdb8438 RCX: 0000000000020000 RDX: ffff97605e6c4c68 RSI: ffff97605e6c4c60 RDI: ffff97615cdb8438 RBP: 000000000000000 R08: 0000000000278333 R09: 0000000000000001 R10: ffff97605e6c4600 R11: 0000000000000001 R12: ffff97605e6c4c68 R13: 0000000000020000 R14: 0000000000000001 R15: ffff976064fe2c00 FS: 000000000000000(0000) GS:ffff9776dfd40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000000008 CR3: 000000005942c002 CR4: 00000000001706f0 Seguimiento de llamadas:  ? __die+0x1f/0x70 ? page_fault_oops+0x15d/0x440 ? search_module_extables+0xe/0x40 ? fixup_exception+0x22/0x2f0 ? exc_page_fault+0x5f/0x100 ? asm_exc_page_fault+0x22/0x30 ? cachefiles_prepare_write+0x30/0xa0 netfs_rreq_write_to_cache_work+0x135/0x2e0 process_one_work+0x137/0x2c0 subproceso_trabajador+0x2e9/0x400 ? __pfx_worker_thread+0x10/0x10 kthread+0xcc/0x100 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x30/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30  M\u00f3dulos vinculados en: CR2: 000000000000008 ---[ fin del seguimiento 000000000000000 ]--- Esto sucedi\u00f3 porque fscache_cookie_state_machine() era lento y todav\u00eda se estaba ejecutando mientras otro proceso invocaba fscache_unuse_cookie(); Esto llev\u00f3 a una llamada a fscache_cookie_lru_do_one(), que estableci\u00f3 el indicador FSCACHE_COOKIE_DO_LRU_DISCARD, que fue detectado por fscache_cookie_state_machine(), retirando la cookie a trav\u00e9s de cachefiles_withdraw_cookie(), borrando cookie-\u0026gt;cache_priv. Al mismo tiempo, otro proceso invoc\u00f3 cachefiles_prepare_write(), que encontr\u00f3 un puntero NULL en esta l\u00ednea de c\u00f3digo: struct cachefiles_object *object = cachefiles_cres_object(cres); La siguiente l\u00ednea falla, obviamente: struct cachefiles_cache *cache = object-\u0026gt;volume-\u0026gt;cache; Durante cachefiles_prepare_write(), el contador \\\"n_accesses\\\" no es cero (a trav\u00e9s de fscache_begin_operation()). La cookie no debe retirarse hasta que baje a cero. El contador se comprueba mediante fscache_cookie_state_machine() antes de cambiar a FSCACHE_COOKIE_STATE_RELINQUISHING y FSCACHE_COOKIE_STATE_WITHDRAWING (en el \\\"caso FSCACHE_COOKIE_STATE_FAILED\\\"), pero no para FSCACHE_COOKIE_STATE_LRU_DISCARDING (\\\"caso FSCACHE_COOKIE_STATE_ACTIVE\\\"). Este parche agrega la comprobaci\u00f3n faltante. Con un contador de acceso distinto de cero, la funci\u00f3n retorna y la siguiente llamada fscache_end_cookie_access() pondr\u00e1 en cola otra llamada fscache_cookie_state_machine() para manejar la FSCACHE_COOKIE_DO_LRU_DISCARD a\u00fan pendiente.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/netfs/fscache_cookie.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"12bb21a29c19aae50cfad4e2bb5c943108f34a7d\",\"lessThan\":\"b8a50877f68efdcc0be3fcc5116e00c31b90e45b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"12bb21a29c19aae50cfad4e2bb5c943108f34a7d\",\"lessThan\":\"dfaa39b05a6cf34a16c525a2759ee6ab26b5fef6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"12bb21a29c19aae50cfad4e2bb5c943108f34a7d\",\"lessThan\":\"0a4d41fa14b2a0efd40e350cfe8ec6a4c998ac1d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"12bb21a29c19aae50cfad4e2bb5c943108f34a7d\",\"lessThan\":\"f71aa06398aabc2e3eaac25acdf3d62e0094ba70\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/netfs/fscache_cookie.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.17\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.17\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.107\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.48\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10.7\",\"lessThanOrEqual\":\"6.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-04T20:18:51.783797Z\",\"id\":\"CVE-2024-45000\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.17\",\"versionEndExcluding\":\"6.1.107\",\"matchCriteriaId\":\"E1FCBB3B-3EA3-4D99-B4C1-E8EA9F3DA097\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.48\",\"matchCriteriaId\":\"9DE9201A-CE6B-4726-BABB-8265EA0F8AE4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.10.7\",\"matchCriteriaId\":\"D2AFDFD1-D95A-4EB7-843B-5E7659518B67\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"8B3CE743-2126-47A3-8B7C-822B502CF119\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4DEB27E7-30AA-45CC-8934-B89263EF3551\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"E0005AEF-856E-47EB-BFE4-90C46899394D\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0a4d41fa14b2a0efd40e350cfe8ec6a4c998ac1d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b8a50877f68efdcc0be3fcc5116e00c31b90e45b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/dfaa39b05a6cf34a16c525a2759ee6ab26b5fef6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f71aa06398aabc2e3eaac25acdf3d62e0094ba70\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T18:17:50+00:00",
      "cve": "CVE-2024-45000",
      "id": "CVE-2024-45000",
      "initial_release_date": "2024-09-04T00:00:00+00:00",
      "product_status:fixed": "305",
      "product_status:known_affected": "64",
      "product_status:known_not_affected": "48",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: fs/netfs/fscache_cookie: add missing \"n_accesses\" check",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-45000.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-29T01:49:13Z",
      "cve": "CVE-2024-45000",
      "id": "CVE-2024-45000",
      "initial_release_date": "2024-09-05T02:46:16Z",
      "product_status:known_affected": "340",
      "product_status:known_not_affected": "288",
      "product_status:recommended": "683",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-45000",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-45000.json",
      "version": "55"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T22:14:58.570Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-45000\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-04T20:18:51.783797Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-04T20:18:55.865Z\"}}], \"cna\": {\"title\": \"fs/netfs/fscache_cookie: add missing \\\"n_accesses\\\" check\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"12bb21a29c19aae50cfad4e2bb5c943108f34a7d\", \"lessThan\": \"b8a50877f68efdcc0be3fcc5116e00c31b90e45b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"12bb21a29c19aae50cfad4e2bb5c943108f34a7d\", \"lessThan\": \"dfaa39b05a6cf34a16c525a2759ee6ab26b5fef6\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"12bb21a29c19aae50cfad4e2bb5c943108f34a7d\", \"lessThan\": \"0a4d41fa14b2a0efd40e350cfe8ec6a4c998ac1d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"12bb21a29c19aae50cfad4e2bb5c943108f34a7d\", \"lessThan\": \"f71aa06398aabc2e3eaac25acdf3d62e0094ba70\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/netfs/fscache_cookie.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.17\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.17\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.107\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.48\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.7\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/netfs/fscache_cookie.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/b8a50877f68efdcc0be3fcc5116e00c31b90e45b\"}, {\"url\": \"https://git.kernel.org/stable/c/dfaa39b05a6cf34a16c525a2759ee6ab26b5fef6\"}, {\"url\": \"https://git.kernel.org/stable/c/0a4d41fa14b2a0efd40e350cfe8ec6a4c998ac1d\"}, {\"url\": \"https://git.kernel.org/stable/c/f71aa06398aabc2e3eaac25acdf3d62e0094ba70\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nfs/netfs/fscache_cookie: add missing \\\"n_accesses\\\" check\\n\\nThis fixes a NULL pointer dereference bug due to a data race which\\nlooks like this:\\n\\n  BUG: kernel NULL pointer dereference, address: 0000000000000008\\n  #PF: supervisor read access in kernel mode\\n  #PF: error_code(0x0000) - not-present page\\n  PGD 0 P4D 0\\n  Oops: 0000 [#1] SMP PTI\\n  CPU: 33 PID: 16573 Comm: kworker/u97:799 Not tainted 6.8.7-cm4all1-hp+ #43\\n  Hardware name: HP ProLiant DL380 Gen9/ProLiant DL380 Gen9, BIOS P89 10/17/2018\\n  Workqueue: events_unbound netfs_rreq_write_to_cache_work\\n  RIP: 0010:cachefiles_prepare_write+0x30/0xa0\\n  Code: 57 41 56 45 89 ce 41 55 49 89 cd 41 54 49 89 d4 55 53 48 89 fb 48 83 ec 08 48 8b 47 08 48 83 7f 10 00 48 89 34 24 48 8b 68 20 \u003c48\u003e 8b 45 08 4c 8b 38 74 45 49 8b 7f 50 e8 4e a9 b0 ff 48 8b 73 10\\n  RSP: 0018:ffffb4e78113bde0 EFLAGS: 00010286\\n  RAX: ffff976126be6d10 RBX: ffff97615cdb8438 RCX: 0000000000020000\\n  RDX: ffff97605e6c4c68 RSI: ffff97605e6c4c60 RDI: ffff97615cdb8438\\n  RBP: 0000000000000000 R08: 0000000000278333 R09: 0000000000000001\\n  R10: ffff97605e6c4600 R11: 0000000000000001 R12: ffff97605e6c4c68\\n  R13: 0000000000020000 R14: 0000000000000001 R15: ffff976064fe2c00\\n  FS:  0000000000000000(0000) GS:ffff9776dfd40000(0000) knlGS:0000000000000000\\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n  CR2: 0000000000000008 CR3: 000000005942c002 CR4: 00000000001706f0\\n  Call Trace:\\n   \u003cTASK\u003e\\n   ? __die+0x1f/0x70\\n   ? page_fault_oops+0x15d/0x440\\n   ? search_module_extables+0xe/0x40\\n   ? fixup_exception+0x22/0x2f0\\n   ? exc_page_fault+0x5f/0x100\\n   ? asm_exc_page_fault+0x22/0x30\\n   ? cachefiles_prepare_write+0x30/0xa0\\n   netfs_rreq_write_to_cache_work+0x135/0x2e0\\n   process_one_work+0x137/0x2c0\\n   worker_thread+0x2e9/0x400\\n   ? __pfx_worker_thread+0x10/0x10\\n   kthread+0xcc/0x100\\n   ? __pfx_kthread+0x10/0x10\\n   ret_from_fork+0x30/0x50\\n   ? __pfx_kthread+0x10/0x10\\n   ret_from_fork_asm+0x1b/0x30\\n   \u003c/TASK\u003e\\n  Modules linked in:\\n  CR2: 0000000000000008\\n  ---[ end trace 0000000000000000 ]---\\n\\nThis happened because fscache_cookie_state_machine() was slow and was\\nstill running while another process invoked fscache_unuse_cookie();\\nthis led to a fscache_cookie_lru_do_one() call, setting the\\nFSCACHE_COOKIE_DO_LRU_DISCARD flag, which was picked up by\\nfscache_cookie_state_machine(), withdrawing the cookie via\\ncachefiles_withdraw_cookie(), clearing cookie-\u003ecache_priv.\\n\\nAt the same time, yet another process invoked\\ncachefiles_prepare_write(), which found a NULL pointer in this code\\nline:\\n\\n  struct cachefiles_object *object = cachefiles_cres_object(cres);\\n\\nThe next line crashes, obviously:\\n\\n  struct cachefiles_cache *cache = object-\u003evolume-\u003ecache;\\n\\nDuring cachefiles_prepare_write(), the \\\"n_accesses\\\" counter is\\nnon-zero (via fscache_begin_operation()).  The cookie must not be\\nwithdrawn until it drops to zero.\\n\\nThe counter is checked by fscache_cookie_state_machine() before\\nswitching to FSCACHE_COOKIE_STATE_RELINQUISHING and\\nFSCACHE_COOKIE_STATE_WITHDRAWING (in \\\"case\\nFSCACHE_COOKIE_STATE_FAILED\\\"), but not for\\nFSCACHE_COOKIE_STATE_LRU_DISCARDING (\\\"case\\nFSCACHE_COOKIE_STATE_ACTIVE\\\").\\n\\nThis patch adds the missing check.  With a non-zero access counter,\\nthe function returns and the next fscache_end_cookie_access() call\\nwill queue another fscache_cookie_state_machine() call to handle the\\nstill-pending FSCACHE_COOKIE_DO_LRU_DISCARD.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.107\", \"versionStartIncluding\": \"5.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.48\", \"versionStartIncluding\": \"5.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.7\", \"versionStartIncluding\": \"5.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11\", \"versionStartIncluding\": \"5.17\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T09:30:45.548Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-45000\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-11-03T22:14:58.570Z\", \"dateReserved\": \"2024-08-21T05:34:56.677Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-09-04T19:54:44.273Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.