PT-2024-29230
CVE-2024-41051
·
Published
2024-06-28
·
Updated
2025-02-03
Description by
CVSS 3.1
7.8
HighMetricsAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
The issue is related to the use of memory after it has been freed in the cachefiles function of the Linux kernel. This can lead to a use-after-free problem when the ondemand object worker function is run after the object has been freed. The problem occurs when the cachefiles object is not pinned and may be freed when a pending read request is completed and the related erofs is umounted.
Technical details about exploitation include:
- The
cachefiles ondemand send req()function sends a read request. - The
cachefiles ondemand fd release()function closes the ondemand fd and sets the object as CLOSE. - The
cachefiles ondemand daemon read()function sets the object as REOPENING and queues theondemand object worker()function. - The
queue work(fscache wq, &info->ondemand work)function queues the work for the ondemand object worker. - The
cachefiles put object()function frees the object. - The
kmem cache free(object)function frees the object's memory.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploitability
Exploit
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾