In the Linux kernel, the following vulnerability has been resolved:
cachefiles: fix slab-use-after-free in cachefiles_withdraw_cookie()
We got the following issue in our fault injection stress test:
================================================================== BUG: KASAN: slab-use-after-free in cachefiles_withdraw_cookie+0x4d9/0x600 Read of size 8 at addr ffff888118efc000 by task kworker/u78:0/109
CPU: 13 PID: 109 Comm: kworker/u78:0 Not tainted 6.8.0-dirty #566 Call Trace: <TASK> kasan_report+0x93/0xc0 cachefiles_withdraw_cookie+0x4d9/0x600 fscache_cookie_state_machine+0x5c8/0x1230 fscache_cookie_worker+0x91/0x1c0 process_one_work+0x7fa/0x1800 [...]
Allocated by task 117: kmalloc_trace+0x1b3/0x3c0 cachefiles_acquire_volume+0xf3/0x9c0 fscache_create_volume_work+0x97/0x150 process_one_work+0x7fa/0x1800 [...]
Freed by task 120301: kfree+0xf1/0x2c0 cachefiles_withdraw_cache+0x3fa/0x920 cachefiles_put_unbind_pincount+0x1f6/0x250 cachefiles_daemon_release+0x13b/0x290 __fput+0x204/0xa00 task_work_run+0x139/0x230 do_exit+0x87a/0x29b0 [...] ==================================================================
Following is the process that triggers the issue:
p1 | p2 ------------------------------------------------------------ fscache_begin_lookup fscache_begin_volume_access fscache_cache_is_live(fscache_cache) cachefiles_daemon_release cachefiles_put_unbind_pincount cachefiles_daemon_unbind cachefiles_withdraw_cache fscache_withdraw_cache fscache_set_cache_state(cache, FSCACHE_CACHE_IS_WITHDRAWN); cachefiles_withdraw_objects(cache) fscache_wait_for_objects(fscache) atomic_read(&fscache_cache->object_count) == 0 fscache_perform_lookup cachefiles_lookup_cookie cachefiles_alloc_object refcount_set(&object->ref, 1); object->volume = volume fscache_count_object(vcookie->cache); atomic_inc(&fscache_cache->object_count) cachefiles_withdraw_volumes cachefiles_withdraw_volume fscache_withdraw_volume __cachefiles_free_volume kfree(cachefiles_volume) fscache_cookie_state_machine cachefiles_withdraw_cookie cache = object->volume->cache; // cachefiles_volume UAF !!!
After setting FSCACHE_CACHE_IS_WITHDRAWN, wait for all the cookie lookups to complete first, and then wait for fscache_cache->object_count == 0 to avoid the cookie exiting after the volume has been freed and triggering the above issue. Therefore call fscache_withdraw_volume() before calling cachefiles_withdraw_objects().
This way, after setting FSCACHE_CACHE_IS_WITHDRAWN, only the following two cases will occur: 1) fscache_begin_lookup fails in fscache_begin_volume_access(). 2) fscache_withdraw_volume() will ensure that fscache_count_object() has been executed before calling fscache_wait_for_objects().
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade kernel-livepatch-6.1.102-108.177Upgrade kernel-tools-debuginfoUpgrade kernel-debuginfoUpgrade kernel-tools-develUpgrade kernel-develUpgrade kernel-modules-extraUpgrade python3-perf-debuginfoUpgrade perfUpgrade python3-perfUpgrade kernel-libbpfUpgrade kernel-debuginfo-common-aarch64Upgrade perf-debuginfoUpgrade bpftoolUpgrade kernel-toolsUpgrade kernel-modules-extra-commonUpgrade bpftool-debuginfoUpgrade kernel-libbpf-develUpgrade kernelUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-libbpf-staticUpgrade kernel-headers | Mar 10, 2025 | Jul 29, 2024 |
| Debian | — | Upgrade linuxUpgrade linux-6.1 | Sep 2, 2024 | Jul 29, 2024 |
| Redhat_linux | — | No solution existsUpgrade kernel-rtUpgrade kernel | Dec 5, 2024 | Jul 29, 2024 |
| Suse | — | Upgrade kernel-64kb-extraUpgrade gfs2-kmp-64kbUpgrade kernel-default-optionalUpgrade reiserfs-kmp-defaultUpgrade dtb-appleUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-default-baseUpgrade dtb-allwinnerUpgrade dtb-amdUpgrade kernel-source-vanillaUpgrade dtb-sprdUpgrade kernel-azure-optionalUpgrade kernel-debug-develUpgrade gfs2-kmp-defaultUpgrade kernel-default-develUpgrade kernel-develUpgrade kernel-rt-develUpgrade kernel-default-livepatch-develUpgrade kernel-rt-livepatchUpgrade dtb-armUpgrade dtb-xilinxUpgrade kernel-64kb-livepatch-develUpgrade dtb-caviumUpgrade kernel-debugUpgrade kernel-defaultUpgrade kernel-64kbUpgrade dtb-alteraUpgrade dtb-mediatekUpgrade dtb-amazonUpgrade dtb-freescaleUpgrade kernel-symsUpgrade dlm-kmp-defaultUpgrade reiserfs-kmp-rtUpgrade kernel-64kb-develUpgrade kernel-azure-extraUpgrade kernel-devel-rtUpgrade cluster-md-kmp-rtUpgrade dtb-socionextUpgrade gfs2-kmp-azureUpgrade kernel-docsUpgrade kselftests-kmp-rtUpgrade kernel-64kb-optionalUpgrade ocfs2-kmp-azureUpgrade dtb-renesasUpgrade ocfs2-kmp-defaultUpgrade dlm-kmp-rtUpgrade dtb-hisiliconUpgrade cluster-md-kmp-64kbUpgrade kernel-default-base-rebuildUpgrade kernel-debug-livepatch-develUpgrade kernel-rt-vdsoUpgrade kernel-rt-livepatch-develUpgrade gfs2-kmp-rtUpgrade dtb-broadcomUpgrade kernel-source-azureUpgrade ocfs2-kmp-64kbUpgrade kselftests-kmp-defaultUpgrade kernel-rt_debug-develUpgrade kernel-docs-htmlUpgrade dlm-kmp-64kbUpgrade kernel-kvmsmall-vdsoUpgrade dtb-nvidiaUpgrade kernel-rtUpgrade cluster-md-kmp-azureUpgrade kernel-kvmsmallUpgrade kernel-azure-vdsoUpgrade kernel-macrosUpgrade dlm-kmp-azureUpgrade kernel-rt-optionalUpgrade dtb-exynosUpgrade kernel-source-rtUpgrade ocfs2-kmp-rtUpgrade kernel-obs-buildUpgrade kernel-rt_debug-vdsoUpgrade kernel-default-vdsoUpgrade kernel-devel-azureUpgrade kernel-azure-develUpgrade kernel-azureUpgrade reiserfs-kmp-64kbUpgrade kselftests-kmp-64kbUpgrade kernel-syms-rtUpgrade kernel-kvmsmall-develUpgrade cluster-md-kmp-defaultUpgrade kernel-syms-azureUpgrade kernel-default-livepatchUpgrade dtb-qcomUpgrade dtb-apmUpgrade kernel-sourceUpgrade kernel-rt-extraUpgrade kernel-obs-qaUpgrade dtb-marvellUpgrade reiserfs-kmp-azureUpgrade kernel-zfcpdumpUpgrade kernel-azure-livepatch-develUpgrade dtb-lgUpgrade kselftests-kmp-azureUpgrade kernel-rt_debugUpgrade kernel-default-extraUpgrade kernel-debug-vdsoUpgrade dtb-amlogicUpgrade dtb-rockchip | Aug 14, 2024 | Jul 29, 2024 |
| Ubuntu | — | Upgrade linux-image-generic-hwe-22.04Upgrade linux-image-6.8.0-1015-oracle-64kUpgrade linux-image-6.8.0-1017-azureUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.8.0-1017-nvidia-64kUpgrade linux-image-azure-fdeUpgrade linux-image-6.8.0-1017-nvidia-lowlatency-64kUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-6.8.0-1016-gcpUpgrade linux-image-awsUpgrade linux-image-6.8.0-1016-oemUpgrade linux-image-oem-22.04bUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-6.8.0-48-genericUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-6.8.0-1016-azureUpgrade linux-image-oem-22.04dUpgrade linux-image-ibm-classicUpgrade linux-image-6.8.0-1014-raspiUpgrade linux-image-6.8.0-1018-awsUpgrade linux-image-6.8.0-1017-azure-fdeUpgrade linux-image-6.8.0-1017-nvidia-lowlatencyUpgrade linux-image-oracleUpgrade linux-image-lowlatency-64k-hwe-24.04Upgrade linux-image-kvmUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-oem-22.04aUpgrade linux-image-6.8.0-1002-gkeopUpgrade linux-image-raspiUpgrade linux-image-6.8.0-48-lowlatencyUpgrade linux-image-6.8.0-1015-oracleUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-oem-24.04aUpgrade linux-image-azureUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-6.8.0-48-lowlatency-64kUpgrade linux-image-gkeop-6.8Upgrade linux-image-nvidiaUpgrade linux-image-oem-24.04Upgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-oem-22.04cUpgrade linux-image-lowlatencyUpgrade linux-image-6.8.0-48-generic-64kUpgrade linux-image-ibmUpgrade linux-image-genericUpgrade linux-image-oracle-64kUpgrade linux-image-gkeopUpgrade linux-image-oem-22.04Upgrade linux-image-6.8.0-1017-gcpUpgrade linux-image-6.8.0-1013-gkeUpgrade linux-image-6.8.0-1017-nvidiaUpgrade linux-image-gkeUpgrade linux-image-nvidia-6.8Upgrade linux-image-generic-64kUpgrade linux-image-6.8.0-1014-ibmUpgrade linux-image-gcpUpgrade linux-image-generic-lpaeUpgrade linux-image-lowlatency-hwe-24.04Upgrade linux-image-virtualUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-nvidia-64kUpgrade linux-image-6.8.0-1016-azure-fdeUpgrade linux-image-lowlatency-64k | Nov 4, 2024 | Jul 29, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 13, 2025 | Jul 29, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub