CVE-2024-41058

CVE Details

Release Date:

2024-07-29

Description

In the Linux kernel, the following vulnerability has been resolved:\ncachefiles: fix slab-use-after-free in fscache_withdraw_volume()\nWe got the following issue in our fault injection stress test:\n==================================================================\nBUG: KASAN: slab-use-after-free in fscache_withdraw_volume+0x2e1/0x370\nRead of size 4 at addr ffff88810680be08 by task ondemand-04-dae/5798\nCPU: 0 PID: 5798 Comm: ondemand-04-dae Not tainted 6.8.0-dirty #565\nCall Trace:\nkasan_check_range+0xf6/0x1b0\nfscache_withdraw_volume+0x2e1/0x370\ncachefiles_withdraw_volume+0x31/0x50\ncachefiles_withdraw_cache+0x3ad/0x900\ncachefiles_put_unbind_pincount+0x1f6/0x250\ncachefiles_daemon_release+0x13b/0x290\n__fput+0x204/0xa00\ntask_work_run+0x139/0x230\nAllocated by task 5820:\n__kmalloc+0x1df/0x4b0\nfscache_alloc_volume+0x70/0x600\n__fscache_acquire_volume+0x1c/0x610\nerofs_fscache_register_volume+0x96/0x1a0\nerofs_fscache_register_fs+0x49a/0x690\nerofs_fc_fill_super+0x6c0/0xcc0\nvfs_get_super+0xa9/0x140\nvfs_get_tree+0x8e/0x300\ndo_new_mount+0x28c/0x580\n[...]\nFreed by task 5820:\nkfree+0xf1/0x2c0\nfscache_put_volume.part.0+0x5cb/0x9e0\nerofs_fscache_unregister_fs+0x157/0x1b0\nerofs_kill_sb+0xd9/0x1c0\ndeactivate_locked_super+0xa3/0x100\nvfs_get_super+0x105/0x140\nvfs_get_tree+0x8e/0x300\ndo_new_mount+0x28c/0x580\n[...]\n==================================================================\nFollowing is the process that triggers the issue:\nmount failed | daemon exit\n------------------------------------------------------------\ndeactivate_locked_super cachefiles_daemon_release\nerofs_kill_sb\nerofs_fscache_unregister_fs\nfscache_relinquish_volume\n__fscache_relinquish_volume\nfscache_put_volume(fscache_volume, fscache_volume_put_relinquish)\nzero = __refcount_dec_and_test(&fscache_volume->ref, &ref);\ncachefiles_put_unbind_pincount\ncachefiles_daemon_unbind\ncachefiles_withdraw_cache\ncachefiles_withdraw_volumes\nlist_del_init(&volume->cache_link)\nfscache_free_volume(fscache_volume)\ncache->ops->free_volume\ncachefiles_free_volume\nlist_del_init(&cachefiles_volume->cache_link);\nkfree(fscache_volume)\ncachefiles_withdraw_volume\nfscache_withdraw_volume\nfscache_volume->n_accesses\n// fscache_volume UAF !!!\nThe fscache_volume in cache->volumes must not have been freed yet, but its\nreference count may be 0. So use the new fscache_try_get_volume() helper\nfunction try to get its reference count.\nIf the reference count of fscache_volume is 0, fscache_put_volume() is\nfreeing it, so wait for it to be removed from cache->volumes.\nIf its reference count is not 0, call cachefiles_withdraw_volume() with\nreference count protection to avoid the above issue.

See more information about CVE-2024-41058 from MITRE CVE dictionary and NIST NVD

CVSS Scoring

NOTE: The following CVSS v3.1 metrics and score provided are preliminary and subject to review.

Base Score:	7	CVSS Vector:	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector:	Local network	Attack Complexity:	High
Privileges Required:	Low	User Interaction:	None
Scope:	Unchanged	Confidentiality Impact:	High
Integrity Impact:	High	Availability Impact:	High

Errata information

Platform	Errata	Release Date
Oracle Linux version 9 (kernel)	ELSA-2024-9315	2024-11-14