CVE-2024-41012

What it actually does

Race between fcntl_setlk and close (or posix_lock_file allocation failure) leaves POSIX file locks partially removed; subsequent lock_get_status reads of /proc/locks perform use-after-free reads that can disclose arbitrary kernel memory.

Why it matters to the business

Linux systems may leak sensitive kernel data to local users, increasing risk of credential or secret exposure and complicating incident response on widely deployed server and endpoint fleets.

How an attack unfolds

An attacker with local access issues concurrent fcntl and close operations (or triggers GFP_KERNEL failure during range split); LSM policy or allocation failure prevents reliable lock removal, leaving a dangling lock structure. Reading /proc/locks then triggers use-after-free reads that can return arbitrary kernel memory contents.

How to fix it

Upgrade the Linux kernel to commit d30ff33040834c3b9eee29740acd92f9c7ba2250 or later; apply the stable update that replaces do_lock_file_wait with locks_remove_posix in the fcntl/close cleanup path.

How to confirm the fix worked

Confirm the running kernel contains commit d30ff33040834c3b9eee29740acd92f9c7ba2250; verify that concurrent fcntl/close no longer produces use-after-free entries in /proc/locks and that lock_get_status handles freed structures safely.

Typical attack path

1. Obtain local unprivileged access on a vulnerable Linux kernel
2. Race fcntl(F_SETLK) against close on the same file descriptor
3. Force LSM denial or memory-allocation failure on the removal path
4. Open and read /proc/locks to trigger lock_get_status UAF
5. Parse leaked kernel memory for credentials or pointers

How to detect it

Review kernel logs for warnings or oops mentioning lock_get_status or posix locks; inspect /proc/locks access patterns from untrusted processes; correlate with unexpected reads of kernel memory regions.

What your security team should do

• Prioritize kernel updates on all internet-facing and multi-tenant Linux hosts
• Enable kernel hardening features (lockdown, lockdown LSM) to limit /proc/locks exposure
• Monitor vendor advisories for backported fixes in distribution kernels
• Audit local applications that perform frequent fcntl locking for race-safe patterns