In the Linux kernel, the following vulnerability has been resolved:
cachefiles: fix slab-use-after-free in cachefiles_ondemand_daemon_read()
We got the following issue in a fuzz test of randomly issuing the restore command:
================================================================== BUG: KASAN: slab-use-after-free in cachefiles_ondemand_daemon_read+0xb41/0xb60 Read of size 8 at addr ffff888122e84088 by task ondemand-04-dae/963
CPU: 13 PID: 963 Comm: ondemand-04-dae Not tainted 6.8.0-dirty #564 Call Trace: kasan_report+0x93/0xc0 cachefiles_ondemand_daemon_read+0xb41/0xb60 vfs_read+0x169/0xb50 ksys_read+0xf5/0x1e0
Allocated by task 116: kmem_cache_alloc+0x140/0x3a0 cachefiles_lookup_cookie+0x140/0xcd0 fscache_cookie_state_machine+0x43c/0x1230 [...]
Freed by task 792: kmem_cache_free+0xfe/0x390 cachefiles_put_object+0x241/0x480 fscache_cookie_state_machine+0x5c8/0x1230 [...] ==================================================================
Following is the process that triggers the issue:
mount | daemon_thread1 | daemon_thread2 ------------------------------------------------------------ cachefiles_withdraw_cookie cachefiles_ondemand_clean_object(object) cachefiles_ondemand_send_req REQ_A = kzalloc(sizeof(*req) + data_len) wait_for_completion(&REQ_A->done)
cachefiles_daemon_read cachefiles_ondemand_daemon_read REQ_A = cachefiles_ondemand_select_req msg->object_id = req->object->ondemand->ondemand_id ------ restore ------ cachefiles_ondemand_restore xas_for_each(&xas, req, ULONG_MAX) xas_set_mark(&xas, CACHEFILES_REQ_NEW)
cachefiles_daemon_read cachefiles_ondemand_daemon_read REQ_A = cachefiles_ondemand_select_req copy_to_user(_buffer, msg, n) xa_erase(&cache->reqs, id) complete(&REQ_A->done) ------ close(fd) ------ cachefiles_ondemand_fd_release cachefiles_put_object cachefiles_put_object kmem_cache_free(cachefiles_object_jar, object) REQ_A->object->ondemand->ondemand_id // object UAF !!!
When we see the request within xa_lock, req->object must not have been freed yet, so grab the reference count of object before xa_unlock to avoid the above issue.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux-6.1Upgrade linux | Jul 18, 2024 | Jul 12, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernel-tools-libsUpgrade kernel-toolsUpgrade kernelUpgrade bpftoolUpgrade python3-perfUpgrade kernel-abi-stablelists | Oct 9, 2024 | Jul 12, 2024 |
| Suse | — | Upgrade kernel-default-livepatch-develUpgrade kernel-default-vdsoUpgrade kernel-default-baseUpgrade kselftests-kmp-defaultUpgrade kernel-develUpgrade dtb-exynosUpgrade gfs2-kmp-rtUpgrade kselftests-kmp-rtUpgrade kernel-64kb-livepatch-develUpgrade dtb-apmUpgrade kernel-rt_debug-livepatch-develUpgrade dtb-mediatekUpgrade dtb-qcomUpgrade ocfs2-kmp-rtUpgrade dtb-xilinxUpgrade ocfs2-kmp-defaultUpgrade ocfs2-kmp-azureUpgrade kernel-debug-develUpgrade kernel-kvmsmall-develUpgrade kernel-rt-develUpgrade dtb-hisiliconUpgrade kernel-obs-qaUpgrade cluster-md-kmp-defaultUpgrade reiserfs-kmp-defaultUpgrade reiserfs-kmp-azureUpgrade cluster-md-kmp-azureUpgrade kernel-defaultUpgrade kernel-symsUpgrade dtb-rockchipUpgrade kernel-sourceUpgrade dlm-kmp-azureUpgrade dtb-allwinnerUpgrade gfs2-kmp-64kbUpgrade kernel-zfcpdumpUpgrade kernel-docsUpgrade kernel-default-base-rebuildUpgrade kernel-macrosUpgrade kernel-64kb-develUpgrade kernel-64kb-optionalUpgrade dtb-renesasUpgrade kernel-default-extraUpgrade dtb-armUpgrade cluster-md-kmp-rtUpgrade kernel-devel-rtUpgrade kernel-debugUpgrade kernel-default-optionalUpgrade ocfs2-kmp-64kbUpgrade kernel-source-azureUpgrade dlm-kmp-64kbUpgrade kernel-azure-extraUpgrade gfs2-kmp-azureUpgrade dtb-broadcomUpgrade kernel-rt-optionalUpgrade kernel-rt-extraUpgrade dtb-amazonUpgrade kernel-source-vanillaUpgrade kernel-kvmsmall-vdsoUpgrade kernel-default-livepatchUpgrade kernel-azure-vdsoUpgrade kernel-kvmsmallUpgrade dtb-nvidiaUpgrade dtb-amlogicUpgrade dlm-kmp-rtUpgrade kernel-syms-azureUpgrade cluster-md-kmp-64kbUpgrade reiserfs-kmp-rtUpgrade kernel-rt_debug-vdsoUpgrade kernel-rt-vdsoUpgrade kernel-azure-livepatch-develUpgrade kernel-azure-develUpgrade gfs2-kmp-defaultUpgrade dtb-lgUpgrade dtb-alteraUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-debug-vdsoUpgrade kernel-obs-buildUpgrade kernel-rt_debugUpgrade kernel-64kbUpgrade dtb-marvellUpgrade kernel-default-develUpgrade kernel-rt-livepatch-develUpgrade kernel-debug-livepatch-develUpgrade kselftests-kmp-64kbUpgrade kernel-rt_debug-develUpgrade kernel-64kb-extraUpgrade dtb-appleUpgrade kernel-source-rtUpgrade kernel-syms-rtUpgrade dtb-amdUpgrade kernel-rtUpgrade dtb-freescaleUpgrade dtb-caviumUpgrade reiserfs-kmp-64kbUpgrade kselftests-kmp-azureUpgrade dlm-kmp-defaultUpgrade kernel-devel-azureUpgrade kernel-docs-htmlUpgrade kernel-azureUpgrade dtb-socionextUpgrade dtb-sprdUpgrade kernel-azure-optional | Dec 5, 2025 | Sep 10, 2024 |
| Ubuntu | — | Upgrade linux-image-6.8.0-44-lowlatencyUpgrade linux-image-gkeUpgrade linux-image-6.8.0-1013-nvidiaUpgrade linux-image-oem-22.04aUpgrade linux-image-azureUpgrade linux-image-ibmUpgrade linux-image-6.8.0-1012-ibmUpgrade linux-image-lowlatency-64kUpgrade linux-image-nvidia-6.8Upgrade linux-image-genericUpgrade linux-image-6.8.0-1012-oemUpgrade linux-image-virtualUpgrade linux-image-6.8.0-1012-oracleUpgrade linux-image-generic-lpaeUpgrade linux-image-6.8.0-45-genericUpgrade linux-image-6.8.0-44-lowlatency-64kUpgrade linux-image-oem-22.04Upgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-raspiUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-44-genericUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-generic-64kUpgrade linux-image-lowlatencyUpgrade linux-image-ibm-classicUpgrade linux-image-6.8.0-1012-oracle-64kUpgrade linux-image-6.8.0-1015-awsUpgrade linux-image-6.8.0-45-generic-64kUpgrade linux-image-oem-22.04cUpgrade linux-image-6.8.0-1014-azureUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-nvidiaUpgrade linux-image-6.8.0-1011-raspiUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-oem-22.04dUpgrade linux-image-oem-22.04bUpgrade linux-image-6.8.0-1014-gcpUpgrade linux-image-6.8.0-1014-azure-fdeUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-6.8.0-44-generic-64kUpgrade linux-image-oracle-64kUpgrade linux-image-azure-fdeUpgrade linux-image-kvmUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.8.0-1013-nvidia-lowlatency-64kUpgrade linux-image-nvidia-64kUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-generic-hwe-22.04Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-awsUpgrade linux-image-gcpUpgrade linux-image-6.8.0-1013-nvidia-lowlatencyUpgrade linux-image-oracleUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-6.8.0-1013-nvidia-64kUpgrade linux-image-6.8.0-1010-gke | Sep 12, 2024 | Jul 12, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub