CVE-2024-41050

What it actually does

Race condition in Linux kernel cachefiles ondemand request handling allows msg_id reuse after malicious early copen completion, causing subsequent open requests to succeed incorrectly and leaving read requests unprocessed, resulting in task hangs.

Why it matters to the business

Systems using affected Linux kernels may experience hangs or unresponsiveness during cachefiles operations, leading to service disruptions, delayed workloads, and potential need for manual intervention or reboots, with moderate prevalence in Linux environments.

How an attack unfolds

An attacker with local access issues a malicious copen completion for an ondemand reopen request to force early success without setting the object closed; a subsequent open request reuses the same msg_id, causing the kernel to treat the malicious response as valid, leaving anonymous fds open and blocking waiting read requests until daemon exit or timeout.

How to fix it

Upgrade the Linux kernel to a version containing commit 35710c6c4a1c64478ec1b5e0e81d386c0844dec6 which implements cyclic msg_id allocation; apply the fix via distribution package manager or rebuild from the stable git tree at the referenced commit.

How to confirm the fix worked

Verify the running kernel contains commit 35710c6c4a1c64478ec1b5e0e81d386c0844dec6 or later; test by exercising cachefiles ondemand reopen paths under load and confirm no hung tasks; review kernel logs for absence of related warnings.

Typical attack path

1. Trigger cachefiles_ondemand_object_is_close and set object reopening
2. Queue ondemand_object_worker and send OPEN request with msg_id
3. Maliciously issue copen for that msg_id to complete the request early without closing the object
4. Initiate new open request that reuses the same msg_id
5. Successful copen on reused msg_id leaves fd open and blocks subsequent read requests causing hang

How to detect it

Search kernel logs and task traces for hung tasks referencing cachefiles_ondemand or ondemand_object_worker; look for repeated msg_id values in cachefiles debug output or daemon interactions around reopen sequences; correlate with copen calls that complete without expected close state changes.

• cachefiles_ondemand_copen
• ondemand_object_worker
• cachefiles_ondemand_send_req(OPEN)
• hung task timeout cachefiles

What your security team should do

• Prioritize kernel upgrade to the fixed commit across all affected systems within standard patch windows
• Monitor for hung tasks involving cachefiles_ondemand in production workloads
• Restrict untrusted local access where possible until patched
• Review downstream dependent packages and rebuild custom kernels if needed