CVE-2024-39510

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-39510
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-39510.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-39510
Downstream
Related
Published
2024-07-12T12:20:40Z
Modified
2025-10-17T08:01:01.004615Z
Summary
cachefiles: fix slab-use-after-free in cachefiles_ondemand_daemon_read()
Details

In the Linux kernel, the following vulnerability has been resolved:

cachefiles: fix slab-use-after-free in cachefilesondemanddaemon_read()

We got the following issue in a fuzz test of randomly issuing the restore command:

================================================================== BUG: KASAN: slab-use-after-free in cachefilesondemanddaemon_read+0xb41/0xb60 Read of size 8 at addr ffff888122e84088 by task ondemand-04-dae/963

CPU: 13 PID: 963 Comm: ondemand-04-dae Not tainted 6.8.0-dirty #564 Call Trace: kasanreport+0x93/0xc0 cachefilesondemanddaemonread+0xb41/0xb60 vfsread+0x169/0xb50 ksysread+0xf5/0x1e0

Allocated by task 116: kmemcachealloc+0x140/0x3a0 cachefileslookupcookie+0x140/0xcd0 fscachecookiestate_machine+0x43c/0x1230 [...]

Freed by task 792: kmemcachefree+0xfe/0x390 cachefilesputobject+0x241/0x480 fscachecookiestate_machine+0x5c8/0x1230

[...]

Following is the process that triggers the issue:

mount | daemonthread1 | daemonthread2

cachefileswithdrawcookie cachefilesondemandcleanobject(object) cachefilesondemandsendreq REQA = kzalloc(sizeof(*req) + datalen) waitforcompletion(&REQ_A->done)

        cachefiles_daemon_read
         cachefiles_ondemand_daemon_read
          REQ_A = cachefiles_ondemand_select_req
          msg->object_id = req->object->ondemand->ondemand_id
                              ------ restore ------
                              cachefiles_ondemand_restore
                              xas_for_each(&xas, req, ULONG_MAX)
                               xas_set_mark(&xas, CACHEFILES_REQ_NEW)

                              cachefiles_daemon_read
                               cachefiles_ondemand_daemon_read
                                REQ_A = cachefiles_ondemand_select_req
          copy_to_user(_buffer, msg, n)
           xa_erase(&cache->reqs, id)
           complete(&REQ_A->done)
          ------ close(fd) ------
          cachefiles_ondemand_fd_release
           cachefiles_put_object

cachefilesputobject kmemcachefree(cachefilesobjectjar, object) REQA->object->ondemand->ondemandid // object UAF !!!

When we see the request within xalock, req->object must not have been freed yet, so grab the reference count of object before xaunlock to avoid the above issue.

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
f17443d52d805c9a7fab5e67a4e8b973626fe1cd
Fixed
cb55625f8eb9d2de8be4da0c4580d48cbb32058e
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
f740fd943bb1fbf79b7eaba3c71eb7536f437f51
Fixed
3958679c49152391209b32be3357193300a51abd
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
0a7e54c1959c0feb2de23397ec09c7692364313e
Fixed
93064676a2820420a2d37d7c8289f277fe20793d
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
0a7e54c1959c0feb2de23397ec09c7692364313e
Fixed
da4a827416066191aafeeccee50a8836a826ba10

Affected versions

v6.*

v6.7
v6.7-rc2
v6.7-rc3
v6.7-rc4
v6.7-rc5
v6.7-rc6
v6.7-rc7
v6.7-rc8
v6.8
v6.8-rc1
v6.8-rc2
v6.8-rc3
v6.8-rc4
v6.8-rc5
v6.8-rc6
v6.8-rc7
v6.9
v6.9-rc1
v6.9-rc2
v6.9-rc3
v6.9-rc4
v6.9-rc5
v6.9-rc6
v6.9-rc7
v6.9.1
v6.9.2
v6.9.3
v6.9.4
v6.9.5

Database specific

vanir_signatures

[
    {
        "id": "CVE-2024-39510-027b8fdf",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "function_hash": "293854793573382297766176161312114010760",
            "length": 1506.0
        },
        "target": {
            "file": "fs/cachefiles/ondemand.c",
            "function": "cachefiles_ondemand_daemon_read"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@da4a827416066191aafeeccee50a8836a826ba10"
    },
    {
        "id": "CVE-2024-39510-2c706cd1",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "function_hash": "293854793573382297766176161312114010760",
            "length": 1506.0
        },
        "target": {
            "file": "fs/cachefiles/ondemand.c",
            "function": "cachefiles_ondemand_daemon_read"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cb55625f8eb9d2de8be4da0c4580d48cbb32058e"
    },
    {
        "id": "CVE-2024-39510-349db689",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "function_hash": "293854793573382297766176161312114010760",
            "length": 1506.0
        },
        "target": {
            "file": "fs/cachefiles/ondemand.c",
            "function": "cachefiles_ondemand_daemon_read"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@93064676a2820420a2d37d7c8289f277fe20793d"
    },
    {
        "id": "CVE-2024-39510-35f98cbd",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "117939319276664519067841140928175322717",
                "145426643870878925334609271198717705854",
                "32354590141657581798807134265178865611",
                "119896270445463159682034779137448357432",
                "187339667958021975236018399629747911443",
                "240954955598485461671575959974425804893",
                "246674455889024679270290299107541360634",
                "13345053890600805227388760862300298396"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "include/trace/events/cachefiles.h"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@93064676a2820420a2d37d7c8289f277fe20793d"
    },
    {
        "id": "CVE-2024-39510-44b2c210",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "117939319276664519067841140928175322717",
                "145426643870878925334609271198717705854",
                "32354590141657581798807134265178865611",
                "119896270445463159682034779137448357432",
                "187339667958021975236018399629747911443",
                "240954955598485461671575959974425804893",
                "246674455889024679270290299107541360634",
                "13345053890600805227388760862300298396"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "include/trace/events/cachefiles.h"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cb55625f8eb9d2de8be4da0c4580d48cbb32058e"
    },
    {
        "id": "CVE-2024-39510-465cf408",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "function_hash": "293854793573382297766176161312114010760",
            "length": 1506.0
        },
        "target": {
            "file": "fs/cachefiles/ondemand.c",
            "function": "cachefiles_ondemand_daemon_read"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3958679c49152391209b32be3357193300a51abd"
    },
    {
        "id": "CVE-2024-39510-7187db28",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "117939319276664519067841140928175322717",
                "145426643870878925334609271198717705854",
                "32354590141657581798807134265178865611",
                "119896270445463159682034779137448357432",
                "187339667958021975236018399629747911443",
                "240954955598485461671575959974425804893",
                "246674455889024679270290299107541360634",
                "13345053890600805227388760862300298396"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "include/trace/events/cachefiles.h"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3958679c49152391209b32be3357193300a51abd"
    },
    {
        "id": "CVE-2024-39510-777a6252",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "311398773785002489435819882747743570695",
                "252630861703773698559549426265079357132",
                "234569894156829121676662996411720177842",
                "243739555280876661426691372566352445166",
                "130069669765219775062628600448065407920",
                "147880212211359971740123090042348037482",
                "308483024067041080952492757263717604641",
                "41644145365812082649241060640677745028",
                "144288991414308100308050945948474389669",
                "144104063486111652137906067607559314373",
                "109423389959311112603383663806374848095"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "fs/cachefiles/ondemand.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cb55625f8eb9d2de8be4da0c4580d48cbb32058e"
    },
    {
        "id": "CVE-2024-39510-a3874647",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "311398773785002489435819882747743570695",
                "252630861703773698559549426265079357132",
                "234569894156829121676662996411720177842",
                "243739555280876661426691372566352445166",
                "130069669765219775062628600448065407920",
                "147880212211359971740123090042348037482",
                "308483024067041080952492757263717604641",
                "41644145365812082649241060640677745028",
                "144288991414308100308050945948474389669",
                "144104063486111652137906067607559314373",
                "109423389959311112603383663806374848095"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "fs/cachefiles/ondemand.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@93064676a2820420a2d37d7c8289f277fe20793d"
    },
    {
        "id": "CVE-2024-39510-c955115c",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "311398773785002489435819882747743570695",
                "252630861703773698559549426265079357132",
                "234569894156829121676662996411720177842",
                "243739555280876661426691372566352445166",
                "130069669765219775062628600448065407920",
                "147880212211359971740123090042348037482",
                "308483024067041080952492757263717604641",
                "41644145365812082649241060640677745028",
                "144288991414308100308050945948474389669",
                "144104063486111652137906067607559314373",
                "109423389959311112603383663806374848095"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "fs/cachefiles/ondemand.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3958679c49152391209b32be3357193300a51abd"
    },
    {
        "id": "CVE-2024-39510-cf1383fc",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "311398773785002489435819882747743570695",
                "252630861703773698559549426265079357132",
                "234569894156829121676662996411720177842",
                "243739555280876661426691372566352445166",
                "130069669765219775062628600448065407920",
                "147880212211359971740123090042348037482",
                "308483024067041080952492757263717604641",
                "41644145365812082649241060640677745028",
                "144288991414308100308050945948474389669",
                "144104063486111652137906067607559314373",
                "109423389959311112603383663806374848095"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "fs/cachefiles/ondemand.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@da4a827416066191aafeeccee50a8836a826ba10"
    },
    {
        "id": "CVE-2024-39510-fa0f117b",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "117939319276664519067841140928175322717",
                "145426643870878925334609271198717705854",
                "32354590141657581798807134265178865611",
                "119896270445463159682034779137448357432",
                "187339667958021975236018399629747911443",
                "240954955598485461671575959974425804893",
                "246674455889024679270290299107541360634",
                "13345053890600805227388760862300298396"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "include/trace/events/cachefiles.h"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@da4a827416066191aafeeccee50a8836a826ba10"
    }
]

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.8.0
Fixed
6.9.6