In the Linux kernel, the following vulnerability has been resolved:
cachefiles: fix slab-use-after-free in cachefiles_ondemand_daemon_read()
We got the following issue in a fuzz test of randomly issuing the restore command:
================================================================== BUG: KASAN: slab-use-after-free in cachefiles_ondemand_daemon_read+0xb41/0xb60 Read of size 8 at addr ffff888122e84088 by task ondemand-04-dae/963
CPU: 13 PID: 963 Comm: ondemand-04-dae Not tainted 6.8.0-dirty #564 Call Trace: kasan_report+0x93/0xc0 cachefiles_ondemand_daemon_read+0xb41/0xb60 vfs_read+0x169/0xb50 ksys_read+0xf5/0x1e0
Allocated by task 116: kmem_cache_alloc+0x140/0x3a0 cachefiles_lookup_cookie+0x140/0xcd0 fscache_cookie_state_machine+0x43c/0x1230 [...]
Freed by task 792: kmem_cache_free+0xfe/0x390 cachefiles_put_object+0x241/0x480 fscache_cookie_state_machine+0x5c8/0x1230 [...] ==================================================================
Following is the process that triggers the issue:
mount | daemon_thread1 | daemon_thread2 ------------------------------------------------------------ cachefiles_withdraw_cookie cachefiles_ondemand_clean_object(object) cachefiles_ondemand_send_req REQ_A = kzalloc(sizeof(*req) + data_len) wait_for_completion(&REQ_A->done)
cachefiles_daemon_read cachefiles_ondemand_daemon_read REQ_A = cachefiles_ondemand_select_req msg->object_id = req->object->ondemand->ondemand_id ------ restore ------ cachefiles_ondemand_restore xas_for_each(&xas, req, ULONG_MAX) xas_set_mark(&xas, CACHEFILES_REQ_NEW)
cachefiles_daemon_read cachefiles_ondemand_daemon_read REQ_A = cachefiles_ondemand_select_req copy_to_user(_buffer, msg, n) xa_erase(&cache->reqs, id) complete(&REQ_A->done) ------ close(fd) ------ cachefiles_ondemand_fd_release cachefiles_put_object cachefiles_put_object kmem_cache_free(cachefiles_object_jar, object) REQ_A->object->ondemand->ondemand_id // object UAF !!!
When we see the request within xa_lock, req->object must not have been freed yet, so grab the reference count of object before xa_unlock to avoid the above issue.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linuxUpgrade linux-6.1 | Jul 18, 2024 | Jul 12, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade python3-perfUpgrade kernel-abi-stablelistsUpgrade kernel-toolsUpgrade kernel-tools-libsUpgrade bpftoolUpgrade kernel | Oct 9, 2024 | Jul 12, 2024 |
| Suse | — | Upgrade cluster-md-kmp-defaultUpgrade dtb-hisiliconUpgrade kernel-sourceUpgrade kernel-kvmsmall-develUpgrade kernel-default-baseUpgrade kernel-zfcpdumpUpgrade ocfs2-kmp-defaultUpgrade kernel-devel-rtUpgrade kselftests-kmp-defaultUpgrade cluster-md-kmp-rtUpgrade dtb-armUpgrade kernel-default-extraUpgrade kselftests-kmp-rtUpgrade kernel-rt_debug-livepatch-develUpgrade ocfs2-kmp-rtUpgrade kernel-64kb-livepatch-develUpgrade gfs2-kmp-64kbUpgrade dtb-apmUpgrade dtb-mediatekUpgrade kernel-debugUpgrade kernel-default-livepatch-develUpgrade dtb-rockchipUpgrade kernel-defaultUpgrade cluster-md-kmp-azureUpgrade kernel-symsUpgrade dtb-renesasUpgrade kernel-docsUpgrade kernel-default-optionalUpgrade reiserfs-kmp-azureUpgrade kernel-64kb-optionalUpgrade kernel-obs-qaUpgrade kernel-default-vdsoUpgrade ocfs2-kmp-azureUpgrade kernel-64kb-develUpgrade dtb-xilinxUpgrade gfs2-kmp-rtUpgrade dlm-kmp-azureUpgrade reiserfs-kmp-defaultUpgrade dtb-qcomUpgrade kernel-develUpgrade kernel-rt-develUpgrade kernel-default-base-rebuildUpgrade kernel-macrosUpgrade kernel-debug-develUpgrade dtb-allwinnerUpgrade dtb-exynosUpgrade kernel-default-develUpgrade kernel-azure-vdsoUpgrade kernel-rt-vdsoUpgrade dlm-kmp-64kbUpgrade dtb-sprdUpgrade dtb-amazonUpgrade kernel-kvmsmall-vdsoUpgrade kernel-default-livepatchUpgrade kselftests-kmp-64kbUpgrade kernel-64kb-extraUpgrade dtb-marvellUpgrade dtb-appleUpgrade kernel-source-vanillaUpgrade kernel-rt-livepatch-develUpgrade reiserfs-kmp-rtUpgrade kselftests-kmp-azureUpgrade kernel-rtUpgrade dtb-freescaleUpgrade dtb-caviumUpgrade dlm-kmp-defaultUpgrade reiserfs-kmp-64kbUpgrade dtb-nvidiaUpgrade kernel-kvmsmallUpgrade dtb-amlogicUpgrade dlm-kmp-rtUpgrade kernel-syms-azureUpgrade kernel-rt_debug-develUpgrade kernel-syms-rtUpgrade kernel-source-rtUpgrade kernel-debug-livepatch-develUpgrade dtb-amdUpgrade kernel-rt-extraUpgrade dtb-broadcomUpgrade kernel-rt-optionalUpgrade kernel-docs-htmlUpgrade kernel-devel-azureUpgrade kernel-azure-optionalUpgrade kernel-azure-extraUpgrade kernel-azureUpgrade gfs2-kmp-azureUpgrade dtb-socionextUpgrade kernel-rt_debug-vdsoUpgrade dtb-alteraUpgrade kernel-source-azureUpgrade kernel-rt_debugUpgrade kernel-obs-buildUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-debug-vdsoUpgrade ocfs2-kmp-64kbUpgrade cluster-md-kmp-64kbUpgrade kernel-azure-develUpgrade gfs2-kmp-defaultUpgrade kernel-azure-livepatch-develUpgrade kernel-64kbUpgrade dtb-lg | Dec 5, 2025 | Sep 10, 2024 |
| Ubuntu | — | Upgrade linux-image-6.8.0-1010-gkeUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-nvidia-64kUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-kvmUpgrade linux-image-oracleUpgrade linux-image-6.8.0-1013-nvidia-64kUpgrade linux-image-6.8.0-1011-raspiUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-awsUpgrade linux-image-azure-fdeUpgrade linux-image-6.8.0-1013-nvidia-lowlatency-64kUpgrade linux-image-gcpUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-6.8.0-1014-gcpUpgrade linux-image-oem-22.04bUpgrade linux-image-6.8.0-1014-azure-fdeUpgrade linux-image-6.8.0-1013-nvidia-lowlatencyUpgrade linux-image-oem-22.04dUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-6.8.0-44-generic-64kUpgrade linux-image-oracle-64kUpgrade linux-image-ibm-classicUpgrade linux-image-6.8.0-1012-oracleUpgrade linux-image-6.8.0-1012-oemUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-nvidia-64k-6.8Upgrade linux-image-6.8.0-45-generic-64kUpgrade linux-image-oem-22.04cUpgrade linux-image-oem-22.04Upgrade linux-image-6.8.0-1013-nvidiaUpgrade linux-image-ibmUpgrade linux-image-lowlatency-64kUpgrade linux-image-virtualUpgrade linux-image-6.8.0-1012-oracle-64kUpgrade linux-image-raspiUpgrade linux-image-gkeUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-lowlatencyUpgrade linux-image-6.8.0-44-lowlatency-64kUpgrade linux-image-6.8.0-44-lowlatencyUpgrade linux-image-6.8.0-1014-azureUpgrade linux-image-nvidia-6.8Upgrade linux-image-oem-22.04aUpgrade linux-image-6.8.0-44-genericUpgrade linux-image-nvidiaUpgrade linux-image-generic-lpaeUpgrade linux-image-generic-64kUpgrade linux-image-azureUpgrade linux-image-6.8.0-1015-awsUpgrade linux-image-6.8.0-1012-ibmUpgrade linux-image-6.8.0-45-genericUpgrade linux-image-generic | Sep 12, 2024 | Jul 12, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub