Cloudanix VulnDB

CVE-2024-39510

None

CVSS

—

EPSS

0.3%

Published

Jul 12, 2024

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A flaw in the Linux kernel's file caching code can let a program accidentally use memory that has already been freed, potentially crashing the whole system.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Other
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in cachefiles_ondemand_daemon_read allows a freed cachefiles_object to be dereferenced after concurrent restore operations and fd release free the underlying slab allocation.

Why it matters to the business

Linux systems relying on cachefiles for on-demand caching may experience kernel crashes or memory corruption; the issue affects stable kernel trees and requires prompt patching to maintain system stability.

How an attack unfolds

An attacker with local access triggers a race by mounting a cachefiles filesystem, issuing concurrent restore commands from multiple daemon threads, and closing file descriptors; this sequence causes the ondemand request to reference an object that has already been freed by cachefiles_put_object.

How to fix it

Upgrade the Linux kernel to the commit cb55625f8eb9d2de8be4da0c4580d48cbb32058e or later; apply the stable backports that hold a reference on the object before releasing the xarray lock.

How to confirm the fix worked

Confirm the running kernel contains commit cb55625f8eb9d2de8be4da0c4580d48cbb32058e; attempt to reproduce the original fuzz sequence under KASAN to verify absence of the slab-use-after-free report.

Typical attack path

  1. Mount filesystem using cachefiles with ondemand mode enabled
  2. Spawn multiple daemon threads performing cachefiles_daemon_read
  3. Issue restore commands that walk the xarray and mark requests
  4. Trigger fd release path that frees the cachefiles_object while a read is still in progress
  5. Dereference the freed object inside cachefiles_ondemand_daemon_read

How to detect it

Search kernel logs and audit trails for KASAN reports citing cachefiles_ondemand_daemon_read, slab-use-after-free, and the ondemand-*-dae process names; correlate with cachefiles mount and restore command activity.

What your security team should do

  • Apply the referenced kernel commit immediately on all affected distributions
  • Prioritize systems that expose cachefiles ondemand interfaces to untrusted local users
  • Monitor kernel logs for KASAN reports mentioning cachefiles_ondemand_daemon_read
  • Disable ondemand mode where operationally feasible until patches are deployed

The record

In the Linux kernel, the following vulnerability has been resolved: cachefiles: fix slab-use-after-free in cachefiles_ondemand_daemon_read() We got the following issue in a fuzz test of randomly issuing the restore command: ================================================================== BUG: KASAN: slab-use-after-free in cachefiles_ondemand_daemon_read+0xb41/0xb60 Read of size 8 at addr ffff888122e84088 by task ondemand-04-dae/963 CPU: 13 PID: 963 Comm: ondemand-04-dae Not tainted 6.8.0-dirty #564 Call Trace: kasan_report+0x93/0xc0 cachefiles_ondemand_daemon_read+0xb41/0xb60 vfs_read+0x169/0xb50 ksys_read+0xf5/0x1e0 Allocated by task 116: kmem_cache_alloc+0x140/0x3a0 cachefiles_lookup_cookie+0x140/0xcd0 fscache_cookie_state_machine+0x43c/0x1230 [...] Freed by task 792: kmem_cache_free+0xfe/0x390 cachefiles_put_object+0x241/0x480 fscache_cookie_state_machine+0x5c8/0x1230 [...] ================================================================== Following is the process that triggers the issue: mount | daemon_thread1 | daemon_thread2 ------------------------------------------------------------ cachefiles_withdraw_cookie cachefiles_ondemand_clean_object(object) cachefiles_ondemand_send_req REQ_A = kzalloc(sizeof(*req) + data_len) wait_for_completion(&REQ_A->done) cachefiles_daemon_read cachefiles_ondemand_daemon_read REQ_A = cachefiles_ondemand_select_req msg->object_id = req->object->ondemand->ondemand_id ------ restore ------ cachefiles_ondemand_restore xas_for_each(&xas, req, ULONG_MAX) xas_set_mark(&xas, CACHEFILES_REQ_NEW) cachefiles_daemon_read cachefiles_ondemand_daemon_read REQ_A = cachefiles_ondemand_select_req copy_to_user(_buffer, msg, n) xa_erase(&cache->reqs, id) complete(&REQ_A->done) ------ close(fd) ------ cachefiles_ondemand_fd_release cachefiles_put_object cachefiles_put_object kmem_cache_free(cachefiles_object_jar, object) REQ_A->object->ondemand->ondemand_id // object UAF !!! When we see the request within xa_lock, req->object must not have been freed yet, so grab the reference count of object before xa_unlock to avoid the above issue.

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 linux-6.1 0 6.1.119-1~deb11u1
Debian:12 linux 0 6.1.99-1
Debian:13 linux 0 6.9.7-1
Linux Kernel 6.8.0 6.9.6
SUSE:Linux Enterprise High Availability Extension 15 SP6 kernel-default 0 6.4.0-150600.23.22.1
SUSE:Linux Enterprise Live Patching 15 SP6 kernel-default 0 6.4.0-150600.23.22.1
SUSE:Linux Enterprise Live Patching 15 SP6 kernel-livepatch-SLE15-SP6-RT_Update_2 0 1-150600.1.3.2
SUSE:Linux Enterprise Live Patching 15 SP6 kernel-livepatch-SLE15-SP6_Update_4 0 1-150600.13.3.3
SUSE:Linux Enterprise Module for Basesystem 15 SP6 kernel-64kb 0 6.4.0-150600.23.22.1
SUSE:Linux Enterprise Module for Basesystem 15 SP6 kernel-default 0 6.4.0-150600.23.22.1
SUSE:Linux Enterprise Module for Basesystem 15 SP6 kernel-default-base 0 6.4.0-150600.23.22.1.150600.12.8.3
SUSE:Linux Enterprise Module for Basesystem 15 SP6 kernel-source 0 6.4.0-150600.23.22.1
SUSE:Linux Enterprise Module for Basesystem 15 SP6 kernel-zfcpdump 0 6.4.0-150600.23.22.1
SUSE:Linux Enterprise Module for Development Tools 15 SP6 kernel-docs 0 6.4.0-150600.23.22.1
SUSE:Linux Enterprise Module for Development Tools 15 SP6 kernel-obs-build 0 6.4.0-150600.23.22.1
SUSE:Linux Enterprise Module for Development Tools 15 SP6 kernel-source 0 6.4.0-150600.23.22.1
SUSE:Linux Enterprise Module for Development Tools 15 SP6 kernel-syms 0 6.4.0-150600.23.22.1
SUSE:Linux Enterprise Module for Legacy 15 SP6 kernel-default 0 6.4.0-150600.23.22.1
SUSE:Linux Enterprise Module for Public Cloud 15 SP6 kernel-azure 0 6.4.0-150600.8.11.1
SUSE:Linux Enterprise Module for Public Cloud 15 SP6 kernel-source-azure 0 6.4.0-150600.8.11.1
SUSE:Linux Enterprise Module for Public Cloud 15 SP6 kernel-syms-azure 0 6.4.0-150600.8.11.1
SUSE:Linux Enterprise Workstation Extension 15 SP6 kernel-default 0 6.4.0-150600.23.22.1
SUSE:Real Time Module 15 SP6 kernel-rt 0 6.4.0-150600.10.8.3
SUSE:Real Time Module 15 SP6 kernel-rt_debug 0 6.4.0-150600.10.8.3
SUSE:Real Time Module 15 SP6 kernel-source-rt 0 6.4.0-150600.10.8.3
SUSE:Real Time Module 15 SP6 kernel-syms-rt 0 6.4.0-150600.10.8.1
Ubuntu:14.04:LTS linux 0 3.11.0-12.19
Ubuntu:14.04:LTS linux-aws 0 4.4.0-1002.2
Ubuntu:14.04:LTS linux-azure 0 4.15.0-1023.24~14.04.1
Ubuntu:14.04:LTS linux-lts-xenial 0 4.4.0-13.29~14.04.1
Ubuntu:16.04:LTS linux 0 4.4.0-2.16
Ubuntu:16.04:LTS linux-aws 0 4.4.0-1001.10
Ubuntu:16.04:LTS linux-aws-hwe 0 4.15.0-1030.31~16.04.1
Ubuntu:16.04:LTS linux-azure 0 4.11.0-1009.9
Ubuntu:16.04:LTS linux-gcp 0 4.10.0-1004.4
Ubuntu:16.04:LTS linux-hwe 0 4.8.0-39.42~16.04.1
Ubuntu:16.04:LTS linux-hwe-edge 0 No fix
Ubuntu:16.04:LTS linux-kvm 0 4.4.0-1004.9
Ubuntu:16.04:LTS linux-oracle 0 4.15.0-1007.9~16.04.1
Ubuntu:18.04:LTS linux 0 4.13.0-16.19
Ubuntu:18.04:LTS linux-aws 0 4.15.0-1001.1
Ubuntu:18.04:LTS linux-aws-5.0 0 No fix
Ubuntu:18.04:LTS linux-aws-5.3 0 No fix
Ubuntu:18.04:LTS linux-aws-5.4 0 5.4.0-1018.18~18.04.1
Ubuntu:18.04:LTS linux-azure 0 No fix
Ubuntu:18.04:LTS linux-azure-4.15 0 4.15.0-1082.92
Ubuntu:18.04:LTS linux-azure-5.3 0 No fix
Ubuntu:18.04:LTS linux-azure-5.4 0 5.4.0-1020.20~18.04.1
Ubuntu:18.04:LTS linux-azure-edge 0 No fix
Ubuntu:18.04:LTS linux-gcp 0 No fix
Ubuntu:18.04:LTS linux-gcp-4.15 0 4.15.0-1071.81
Ubuntu:18.04:LTS linux-gcp-5.3 0 No fix
Ubuntu:18.04:LTS linux-gcp-5.4 0 5.4.0-1019.19~18.04.2
Ubuntu:18.04:LTS linux-gke-4.15 0 No fix
Ubuntu:18.04:LTS linux-gke-5.4 0 No fix
Ubuntu:18.04:LTS linux-gkeop-5.4 0 No fix
Ubuntu:18.04:LTS linux-hwe 0 No fix
Ubuntu:18.04:LTS linux-hwe-5.4 0 5.4.0-37.41~18.04.1
Ubuntu:18.04:LTS linux-hwe-edge 0 5.0.0-15.16~18.04.1
Ubuntu:18.04:LTS linux-ibm-5.4 0 5.4.0-1010.11~18.04.2
Ubuntu:18.04:LTS linux-kvm 0 4.15.0-1002.2
Ubuntu:18.04:LTS linux-oem 0 No fix
Ubuntu:18.04:LTS linux-oracle 0 4.15.0-1007.9
Ubuntu:18.04:LTS linux-oracle-5.0 0 No fix
Ubuntu:18.04:LTS linux-oracle-5.3 0 No fix
Ubuntu:18.04:LTS linux-oracle-5.4 0 5.4.0-1019.19~18.04.1
Ubuntu:18.04:LTS linux-raspi-5.4 0 5.4.0-1013.13~18.04.1
Ubuntu:20.04:LTS linux 0 No fix
Ubuntu:20.04:LTS linux 0 5.4.0-9.12
Ubuntu:20.04:LTS linux-aws 0 No fix
Ubuntu:20.04:LTS linux-aws 0 5.4.0-1005.5
Ubuntu:20.04:LTS linux-aws-5.11 0 No fix
Ubuntu:20.04:LTS linux-aws-5.13 0 No fix
Ubuntu:20.04:LTS linux-aws-5.15 0 No fix
Ubuntu:20.04:LTS linux-aws-5.15 0 5.15.0-1014.18~20.04.1
Ubuntu:20.04:LTS linux-aws-5.8 0 No fix
Ubuntu:20.04:LTS linux-azure 0 No fix
Ubuntu:20.04:LTS linux-azure 0 5.4.0-1006.6
Ubuntu:20.04:LTS linux-azure-5.11 0 No fix
Ubuntu:20.04:LTS linux-azure-5.13 0 No fix
Ubuntu:20.04:LTS linux-azure-5.15 0 No fix
Ubuntu:20.04:LTS linux-azure-5.15 0 5.15.0-1007.8~20.04.1
Ubuntu:20.04:LTS linux-azure-5.8 0 No fix
Ubuntu:20.04:LTS linux-azure-fde 0 No fix
Ubuntu:20.04:LTS linux-azure-fde-5.15 0 No fix
Ubuntu:20.04:LTS linux-azure-fde-5.15 0 5.15.0-1019.24~20.04.1.1
Ubuntu:20.04:LTS linux-bluefield 0 No fix
Ubuntu:20.04:LTS linux-bluefield 0 5.4.0-1007.10
Ubuntu:20.04:LTS linux-gcp 0 No fix
Ubuntu:20.04:LTS linux-gcp 0 5.4.0-1005.5
Ubuntu:20.04:LTS linux-gcp-5.11 0 No fix
Ubuntu:20.04:LTS linux-gcp-5.13 0 No fix
Ubuntu:20.04:LTS linux-gcp-5.15 0 No fix
Ubuntu:20.04:LTS linux-gcp-5.15 0 5.15.0-1006.9~20.04.1
Ubuntu:20.04:LTS linux-gcp-5.8 0 No fix
Ubuntu:20.04:LTS linux-gke 0 No fix
Ubuntu:20.04:LTS linux-gke-5.15 0 No fix
Ubuntu:20.04:LTS linux-gkeop 0 No fix
Ubuntu:20.04:LTS linux-gkeop 0 5.4.0-1008.9
Ubuntu:20.04:LTS linux-gkeop-5.15 0 No fix
Ubuntu:20.04:LTS linux-gkeop-5.15 0 5.15.0-1003.5~20.04.2
Ubuntu:20.04:LTS linux-hwe-5.11 0 No fix
Ubuntu:20.04:LTS linux-hwe-5.13 0 No fix
Ubuntu:20.04:LTS linux-hwe-5.15 0 No fix
Ubuntu:20.04:LTS linux-hwe-5.15 0 5.15.0-33.34~20.04.1
Ubuntu:20.04:LTS linux-hwe-5.8 0 No fix
Ubuntu:20.04:LTS linux-ibm 0 No fix
Ubuntu:20.04:LTS linux-ibm 0 5.4.0-1003.4
Ubuntu:20.04:LTS linux-ibm-5.15 0 No fix
Ubuntu:20.04:LTS linux-ibm-5.15 0 5.15.0-1033.36~20.04.1
Ubuntu:20.04:LTS linux-intel-5.13 0 No fix
Ubuntu:20.04:LTS linux-intel-iotg-5.15 0 No fix
Ubuntu:20.04:LTS linux-intel-iotg-5.15 0 5.15.0-1003.5~20.04.1
Ubuntu:20.04:LTS linux-iot 0 No fix
Ubuntu:20.04:LTS linux-iot 0 5.4.0-1001.3
Ubuntu:20.04:LTS linux-kvm 0 No fix
Ubuntu:20.04:LTS linux-kvm 0 5.4.0-1004.4
Ubuntu:20.04:LTS linux-lowlatency-hwe-5.15 0 No fix
Ubuntu:20.04:LTS linux-lowlatency-hwe-5.15 0 5.15.0-33.34~20.04.1
Ubuntu:20.04:LTS linux-oem-5.10 0 No fix
Ubuntu:20.04:LTS linux-oem-5.13 0 No fix
Ubuntu:20.04:LTS linux-oem-5.14 0 No fix
Ubuntu:20.04:LTS linux-oem-5.6 0 No fix
Ubuntu:20.04:LTS linux-oracle 0 No fix
Ubuntu:20.04:LTS linux-oracle 0 5.4.0-1005.5
Ubuntu:20.04:LTS linux-oracle-5.11 0 No fix
Ubuntu:20.04:LTS linux-oracle-5.13 0 No fix
Ubuntu:20.04:LTS linux-oracle-5.15 0 No fix
Ubuntu:20.04:LTS linux-oracle-5.15 0 5.15.0-1007.9~20.04.1
Ubuntu:20.04:LTS linux-oracle-5.8 0 No fix
Ubuntu:20.04:LTS linux-raspi 0 No fix
Ubuntu:20.04:LTS linux-raspi 0 5.4.0-1007.7
Ubuntu:20.04:LTS linux-raspi2 0 No fix
Ubuntu:20.04:LTS linux-riscv 0 No fix
Ubuntu:20.04:LTS linux-riscv-5.11 0 No fix
Ubuntu:20.04:LTS linux-riscv-5.15 0 No fix
Ubuntu:20.04:LTS linux-riscv-5.15 0 5.15.0-1015.17~20.04.1
Ubuntu:20.04:LTS linux-riscv-5.8 0 No fix
Ubuntu:20.04:LTS linux-xilinx-zynqmp 0 No fix
Ubuntu:20.04:LTS linux-xilinx-zynqmp 0 5.4.0-1020.24
Ubuntu:22.04:LTS linux 0 No fix
Ubuntu:22.04:LTS linux 0 5.13.0-19.19
Ubuntu:22.04:LTS linux-allwinner-5.19 0 No fix
Ubuntu:22.04:LTS linux-aws 0 No fix
Ubuntu:22.04:LTS linux-aws 0 5.13.0-1005.6
Ubuntu:22.04:LTS linux-aws-5.19 0 No fix
Ubuntu:22.04:LTS linux-aws-6.2 0 No fix
Ubuntu:22.04:LTS linux-aws-6.5 0 No fix
Ubuntu:22.04:LTS linux-aws-6.8 0 6.8.0-1015.16~22.04.1
Ubuntu:22.04:LTS linux-azure 0 No fix
Ubuntu:22.04:LTS linux-azure 0 5.13.0-1006.7
Ubuntu:22.04:LTS linux-azure-5.19 0 No fix
Ubuntu:22.04:LTS linux-azure-6.2 0 No fix
Ubuntu:22.04:LTS linux-azure-6.5 0 No fix
Ubuntu:22.04:LTS linux-azure-6.8 0 No fix
Ubuntu:22.04:LTS linux-azure-6.8 0 6.8.0-1014.16~22.04.1
Ubuntu:22.04:LTS linux-azure-fde 0 No fix
Ubuntu:22.04:LTS linux-azure-fde 0 5.15.0-1019.24.1
Ubuntu:22.04:LTS linux-azure-fde-5.19 0 No fix
Ubuntu:22.04:LTS linux-azure-fde-6.2 0 No fix
Ubuntu:22.04:LTS linux-gcp 0 No fix
Ubuntu:22.04:LTS linux-gcp 0 5.13.0-1005.6
Ubuntu:22.04:LTS linux-gcp-5.19 0 No fix
Ubuntu:22.04:LTS linux-gcp-6.2 0 No fix
Ubuntu:22.04:LTS linux-gcp-6.5 0 No fix
Ubuntu:22.04:LTS linux-gcp-6.8 0 6.8.0-1014.16~22.04.1
Ubuntu:22.04:LTS linux-gke 0 No fix
Ubuntu:22.04:LTS linux-gke 0 5.15.0-1002.2
Ubuntu:22.04:LTS linux-gkeop 0 No fix
Ubuntu:22.04:LTS linux-gkeop 0 5.15.0-1001.2
Ubuntu:22.04:LTS linux-hwe-5.19 0 No fix
Ubuntu:22.04:LTS linux-hwe-6.2 0 No fix
Ubuntu:22.04:LTS linux-hwe-6.5 0 No fix
Ubuntu:22.04:LTS linux-hwe-6.8 0 6.8.0-45.45~22.04.1
Ubuntu:22.04:LTS linux-ibm 0 No fix
Ubuntu:22.04:LTS linux-ibm 0 5.15.0-1002.2
Ubuntu:22.04:LTS linux-intel-iot-realtime 0 No fix
Ubuntu:22.04:LTS linux-intel-iot-realtime 0 5.15.0-1021.26
Ubuntu:22.04:LTS linux-intel-iotg 0 No fix
Ubuntu:22.04:LTS linux-intel-iotg 0 5.15.0-1004.6
Ubuntu:22.04:LTS linux-kvm 0 No fix
Ubuntu:22.04:LTS linux-kvm 0 5.13.0-1004.4
Ubuntu:22.04:LTS linux-lowlatency 0 No fix
Ubuntu:22.04:LTS linux-lowlatency 0 5.15.0-22.22
Ubuntu:22.04:LTS linux-lowlatency-hwe-5.19 0 No fix
Ubuntu:22.04:LTS linux-lowlatency-hwe-6.2 0 No fix
Ubuntu:22.04:LTS linux-lowlatency-hwe-6.5 0 No fix
Ubuntu:22.04:LTS linux-lowlatency-hwe-6.8 0 6.8.0-44.44.1~22.04.1
Ubuntu:22.04:LTS linux-nvidia 0 No fix
Ubuntu:22.04:LTS linux-nvidia 0 5.15.0-1005.5
Ubuntu:22.04:LTS linux-nvidia-6.2 0 No fix
Ubuntu:22.04:LTS linux-nvidia-6.5 0 No fix
Ubuntu:22.04:LTS linux-nvidia-6.5 0 6.5.0-1004.4
Ubuntu:22.04:LTS linux-nvidia-6.8 0 6.8.0-1013.14~22.04.1
Ubuntu:22.04:LTS linux-oem-5.17 0 No fix
Ubuntu:22.04:LTS linux-oem-6.0 0 No fix
Ubuntu:22.04:LTS linux-oem-6.1 0 No fix
Ubuntu:22.04:LTS linux-oem-6.5 0 No fix
Ubuntu:22.04:LTS linux-oracle 0 No fix
Ubuntu:22.04:LTS linux-oracle 0 5.13.0-1008.10

Related vulnerabilities