In the Linux kernel, the following vulnerability has been resolved:
cachefiles: fix slab-use-after-free in cachefiles_ondemand_daemon_read()
We got the following issue in a fuzz test of randomly issuing the restore command:
================================================================== BUG: KASAN: slab-use-after-free in cachefiles_ondemand_daemon_read+0xb41/0xb60 Read of size 8 at addr ffff888122e84088 by task ondemand-04-dae/963
CPU: 13 PID: 963 Comm: ondemand-04-dae Not tainted 6.8.0-dirty #564 Call Trace: kasan_report+0x93/0xc0 cachefiles_ondemand_daemon_read+0xb41/0xb60 vfs_read+0x169/0xb50 ksys_read+0xf5/0x1e0
Allocated by task 116: kmem_cache_alloc+0x140/0x3a0 cachefiles_lookup_cookie+0x140/0xcd0 fscache_cookie_state_machine+0x43c/0x1230 [...]
Freed by task 792: kmem_cache_free+0xfe/0x390 cachefiles_put_object+0x241/0x480 fscache_cookie_state_machine+0x5c8/0x1230 [...] ==================================================================
Following is the process that triggers the issue:
mount | daemon_thread1 | daemon_thread2 ------------------------------------------------------------ cachefiles_withdraw_cookie cachefiles_ondemand_clean_object(object) cachefiles_ondemand_send_req REQ_A = kzalloc(sizeof(*req) + data_len) wait_for_completion(&REQ_A->done)
cachefiles_daemon_read cachefiles_ondemand_daemon_read REQ_A = cachefiles_ondemand_select_req msg->object_id = req->object->ondemand->ondemand_id ------ restore ------ cachefiles_ondemand_restore xas_for_each(&xas, req, ULONG_MAX) xas_set_mark(&xas, CACHEFILES_REQ_NEW)
cachefiles_daemon_read cachefiles_ondemand_daemon_read REQ_A = cachefiles_ondemand_select_req copy_to_user(_buffer, msg, n) xa_erase(&cache->reqs, id) complete(&REQ_A->done) ------ close(fd) ------ cachefiles_ondemand_fd_release cachefiles_put_object cachefiles_put_object kmem_cache_free(cachefiles_object_jar, object) REQ_A->object->ondemand->ondemand_id // object UAF !!!
When we see the request within xa_lock, req->object must not have been freed yet, so grab the reference count of object before xa_unlock to avoid the above issue.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux-6.1Upgrade linux | Jul 18, 2024 | Jul 12, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernel-tools-libsUpgrade kernel-toolsUpgrade kernelUpgrade bpftoolUpgrade kernel-abi-stablelistsUpgrade python3-perf | Oct 9, 2024 | Jul 12, 2024 |
| Suse | — | Upgrade kernel-debug-livepatch-develUpgrade kernel-rt_debug-develUpgrade kernel-source-rtUpgrade dtb-marvellUpgrade kernel-default-develUpgrade dtb-appleUpgrade kernel-rt-livepatch-develUpgrade kernel-64kb-extraUpgrade kselftests-kmp-64kbUpgrade kernel-syms-rtUpgrade kernel-rtUpgrade kselftests-kmp-azureUpgrade dtb-caviumUpgrade kernel-obs-buildUpgrade dlm-kmp-defaultUpgrade reiserfs-kmp-64kbUpgrade kernel-kvmsmallUpgrade ocfs2-kmp-64kbUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-source-azureUpgrade dtb-freescaleUpgrade kernel-rt_debugUpgrade dtb-amdUpgrade kernel-syms-azureUpgrade kernel-azure-livepatch-develUpgrade kernel-64kbUpgrade kernel-azure-develUpgrade cluster-md-kmp-64kbUpgrade dlm-kmp-64kbUpgrade kernel-azureUpgrade dtb-alteraUpgrade dlm-kmp-rtUpgrade kernel-docs-htmlUpgrade dtb-broadcomUpgrade gfs2-kmp-defaultUpgrade kernel-debug-vdsoUpgrade kernel-rt-vdsoUpgrade kernel-rt-optionalUpgrade gfs2-kmp-azureUpgrade kernel-azure-vdsoUpgrade kernel-default-livepatchUpgrade kernel-azure-extraUpgrade dtb-amazonUpgrade kernel-rt-extraUpgrade dtb-sprdUpgrade kernel-devel-azureUpgrade kernel-source-vanillaUpgrade dtb-socionextUpgrade kernel-azure-optionalUpgrade kernel-kvmsmall-vdsoUpgrade kernel-rt_debug-vdsoUpgrade dtb-nvidiaUpgrade dtb-amlogicUpgrade reiserfs-kmp-rtUpgrade dtb-lgUpgrade kernel-defaultUpgrade gfs2-kmp-rtUpgrade kselftests-kmp-defaultUpgrade kernel-default-vdsoUpgrade cluster-md-kmp-rtUpgrade kernel-zfcpdumpUpgrade kernel-docsUpgrade kernel-devel-rtUpgrade kernel-default-extraUpgrade kernel-64kb-optionalUpgrade kernel-64kb-develUpgrade dtb-renesasUpgrade dtb-armUpgrade kernel-macrosUpgrade kernel-default-livepatch-develUpgrade dtb-allwinnerUpgrade ocfs2-kmp-defaultUpgrade kselftests-kmp-rtUpgrade kernel-default-baseUpgrade reiserfs-kmp-defaultUpgrade kernel-rt-develUpgrade cluster-md-kmp-azureUpgrade reiserfs-kmp-azureUpgrade kernel-symsUpgrade kernel-obs-qaUpgrade dtb-rockchipUpgrade kernel-debugUpgrade kernel-default-optionalUpgrade kernel-default-base-rebuildUpgrade gfs2-kmp-64kbUpgrade kernel-sourceUpgrade kernel-kvmsmall-develUpgrade kernel-debug-develUpgrade dtb-hisiliconUpgrade cluster-md-kmp-defaultUpgrade ocfs2-kmp-azureUpgrade dtb-apmUpgrade dtb-mediatekUpgrade ocfs2-kmp-rtUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-64kb-livepatch-develUpgrade dtb-xilinxUpgrade dtb-exynosUpgrade dlm-kmp-azureUpgrade kernel-develUpgrade dtb-qcom | Dec 5, 2025 | Sep 10, 2024 |
| Ubuntu | — | Upgrade linux-image-nvidiaUpgrade linux-image-oem-22.04cUpgrade linux-image-ibmUpgrade linux-image-6.8.0-45-generic-64kUpgrade linux-image-virtualUpgrade linux-image-6.8.0-44-genericUpgrade linux-image-raspiUpgrade linux-image-6.8.0-1012-ibmUpgrade linux-image-lowlatency-64kUpgrade linux-image-6.8.0-1013-nvidiaUpgrade linux-image-generic-lpaeUpgrade linux-image-genericUpgrade linux-image-oem-22.04aUpgrade linux-image-6.8.0-1012-oracleUpgrade linux-image-6.8.0-45-genericUpgrade linux-image-lowlatencyUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-6.8.0-44-lowlatency-64kUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-6.8.0-1012-oemUpgrade linux-image-6.8.0-44-lowlatencyUpgrade linux-image-6.8.0-1012-oracle-64kUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-nvidia-6.8Upgrade linux-image-ibm-classicUpgrade linux-image-6.8.0-1014-azureUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-gkeUpgrade linux-image-azureUpgrade linux-image-oem-22.04Upgrade linux-image-6.8.0-1015-awsUpgrade linux-image-generic-64kUpgrade linux-image-kvmUpgrade linux-image-6.8.0-1014-gcpUpgrade linux-image-gcpUpgrade linux-image-azure-fdeUpgrade linux-image-nvidia-64kUpgrade linux-image-6.8.0-1013-nvidia-lowlatencyUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-oem-22.04dUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-6.8.0-1014-azure-fdeUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-oem-22.04bUpgrade linux-image-oracleUpgrade linux-image-6.8.0-1010-gkeUpgrade linux-image-6.8.0-1013-nvidia-64kUpgrade linux-image-6.8.0-44-generic-64kUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-6.8.0-1011-raspiUpgrade linux-image-oracle-64kUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-awsUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.8.0-1013-nvidia-lowlatency-64kUpgrade linux-image-generic-64k-hwe-24.04 | Sep 12, 2024 | Jul 12, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub