CVE-2024-40900
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2024-40900
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-40900.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2024-40900
- Downstream
- Related
- Published
- 2024-07-12T12:20:42Z
- Modified
- 2025-11-04T04:40:18.802164Z
- Summary
- cachefiles: remove requests from xarray during flushing requests
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
cachefiles: remove requests from xarray during flushing requests
Even with CACHEFILES_DEAD set, we can still read the requests, so in the following concurrency the request may be used after it has been freed:
mount | daemonthread1 | daemonthread2
cachefilesondemandinitobject cachefilesondemandsendreq REQA = kzalloc(sizeof(*req) + datalen) waitforcompletion(&REQA->done) cachefilesdaemonread cachefilesondemanddaemonread // close dev fd cachefilesflushreqs complete(&REQA->done) kfree(REQA) xalock(&cache->reqs); cachefilesondemandselectreq req->msg.opcode != CACHEFILESOPREAD // req use-after-free !!! xaunlock(&cache->reqs); xadestroy(&cache->reqs)
Hence remove requests from cache->reqs when flushing them to avoid accessing freed requests.
- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/0fc75c5940fa634d84e64c93bfc388e1274ed013
- https://git.kernel.org/stable/c/37e19cf86a520d65de1de9cb330415c332a40d19
- https://git.kernel.org/stable/c/50d0e55356ba5b84ffb51c42704126124257e598
- https://git.kernel.org/stable/c/9f13aacdd4ee9a7644b2a3c96d67113cd083c9c7
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedc8383054506c77b814489c09877b5db83fd4abf2Fixed9f13aacdd4ee9a7644b2a3c96d67113cd083c9c7
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedc8383054506c77b814489c09877b5db83fd4abf2Fixed50d0e55356ba5b84ffb51c42704126124257e598
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedc8383054506c77b814489c09877b5db83fd4abf2Fixed37e19cf86a520d65de1de9cb330415c332a40d19
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedc8383054506c77b814489c09877b5db83fd4abf2Fixed0fc75c5940fa634d84e64c93bfc388e1274ed013
Affected versions
v5.*
v5.18
v5.18-rc5
v5.18-rc6
v5.18-rc7
v5.19
v5.19-rc1
v5.19-rc2
v5.19-rc3
v5.19-rc4
v5.19-rc5
v5.19-rc6
v5.19-rc7
v5.19-rc8
v6.*
v6.0
v6.0-rc1
v6.0-rc2
v6.0-rc3
v6.0-rc4
v6.0-rc5
v6.0-rc6
v6.0-rc7
v6.1
v6.1-rc1
v6.1-rc2
v6.1-rc3
v6.1-rc4
v6.1-rc5
v6.1-rc6
v6.1-rc7
v6.1-rc8
v6.1.1
v6.1.10
v6.1.11
v6.1.12
v6.1.13
v6.1.14
v6.1.15
v6.1.16
v6.1.17
v6.1.18
v6.1.19
v6.1.2
v6.1.20
v6.1.21
v6.1.22
v6.1.23
v6.1.24
v6.1.25
v6.1.26
v6.1.27
v6.1.28
v6.1.29
v6.1.3
v6.1.30
v6.1.31
v6.1.32
v6.1.33
v6.1.34
v6.1.35
v6.1.36
v6.1.37
v6.1.38
v6.1.39
v6.1.4
v6.1.40
v6.1.41
v6.1.42
v6.1.43
v6.1.44
v6.1.45
v6.1.46
v6.1.47
v6.1.48
v6.1.49
v6.1.5
v6.1.50
v6.1.51
v6.1.52
v6.1.53
v6.1.54
v6.1.55
v6.1.56
v6.1.57
v6.1.58
v6.1.59
v6.1.6
v6.1.60
v6.1.61
v6.1.62
v6.1.63
v6.1.64
v6.1.65
v6.1.66
v6.1.67
v6.1.68
v6.1.69
v6.1.7
v6.1.70
v6.1.71
v6.1.72
v6.1.73
v6.1.74
v6.1.75
v6.1.76
v6.1.77
v6.1.78
v6.1.79
v6.1.8
v6.1.80
v6.1.81
v6.1.82
v6.1.83
v6.1.84
v6.1.85
v6.1.86
v6.1.87
v6.1.88
v6.1.89
v6.1.9
v6.1.90
v6.1.91
v6.1.92
v6.1.93
v6.1.94
v6.2
v6.2-rc1
v6.2-rc2
v6.2-rc3
v6.2-rc4
v6.2-rc5
v6.2-rc6
v6.2-rc7
v6.2-rc8
v6.3
v6.3-rc1
v6.3-rc2
v6.3-rc3
v6.3-rc4
v6.3-rc5
v6.3-rc6
v6.3-rc7
v6.4
v6.4-rc1
v6.4-rc2
v6.4-rc3
v6.4-rc4
v6.4-rc5
v6.4-rc6
v6.4-rc7
v6.5
v6.5-rc1
v6.5-rc2
v6.5-rc3
v6.5-rc4
v6.5-rc5
v6.5-rc6
v6.5-rc7
v6.6
v6.6-rc1
v6.6-rc2
v6.6-rc3
v6.6-rc4
v6.6-rc5
v6.6-rc6
v6.6-rc7
v6.6.1
v6.6.10
v6.6.11
v6.6.12
v6.6.13
v6.6.14
v6.6.15
v6.6.16
v6.6.17
v6.6.18
v6.6.19
v6.6.2
v6.6.20
v6.6.21
v6.6.22
v6.6.23
v6.6.24
v6.6.25
v6.6.26
v6.6.27
v6.6.28
v6.6.29
v6.6.3
v6.6.30
v6.6.31
v6.6.32
v6.6.33
v6.6.34
v6.6.4
v6.6.5
v6.6.6
v6.6.7
v6.6.8
v6.6.9
v6.7
v6.7-rc1
v6.7-rc2
v6.7-rc3
v6.7-rc4
v6.7-rc5
v6.7-rc6
v6.7-rc7
v6.7-rc8
v6.8
v6.8-rc1
v6.8-rc2
v6.8-rc3
v6.8-rc4
v6.8-rc5
v6.8-rc6
v6.8-rc7
v6.9
v6.9-rc1
v6.9-rc2
v6.9-rc3
v6.9-rc4
v6.9-rc5
v6.9-rc6
v6.9-rc7
v6.9.1
v6.9.2
v6.9.3
v6.9.4
v6.9.5
Database specific
vanir_signatures
[
{
"id": "CVE-2024-40900-09126e5c",
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "fs/cachefiles/daemon.c",
"function": "cachefiles_flush_reqs"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@50d0e55356ba5b84ffb51c42704126124257e598",
"signature_version": "v1",
"digest": {
"length": 321.0,
"function_hash": "282506108123091286457195073191085585515"
}
},
{
"id": "CVE-2024-40900-304c4f59",
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "fs/cachefiles/daemon.c",
"function": "cachefiles_flush_reqs"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9f13aacdd4ee9a7644b2a3c96d67113cd083c9c7",
"signature_version": "v1",
"digest": {
"length": 321.0,
"function_hash": "282506108123091286457195073191085585515"
}
},
{
"id": "CVE-2024-40900-a55f1244",
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "fs/cachefiles/daemon.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@37e19cf86a520d65de1de9cb330415c332a40d19",
"signature_version": "v1",
"digest": {
"line_hashes": [
"133368490668874490762107831458119947499",
"87146630799270410229938242051576640373",
"172176499812823668186824265549417495836",
"85349179178899306129855673688386906462"
],
"threshold": 0.9
}
},
{
"id": "CVE-2024-40900-b4c3026f",
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "fs/cachefiles/daemon.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@50d0e55356ba5b84ffb51c42704126124257e598",
"signature_version": "v1",
"digest": {
"line_hashes": [
"133368490668874490762107831458119947499",
"87146630799270410229938242051576640373",
"172176499812823668186824265549417495836",
"85349179178899306129855673688386906462"
],
"threshold": 0.9
}
},
{
"id": "CVE-2024-40900-c7ab4d90",
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "fs/cachefiles/daemon.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9f13aacdd4ee9a7644b2a3c96d67113cd083c9c7",
"signature_version": "v1",
"digest": {
"line_hashes": [
"133368490668874490762107831458119947499",
"87146630799270410229938242051576640373",
"172176499812823668186824265549417495836",
"85349179178899306129855673688386906462"
],
"threshold": 0.9
}
},
{
"id": "CVE-2024-40900-e45c1e35",
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "fs/cachefiles/daemon.c",
"function": "cachefiles_flush_reqs"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@37e19cf86a520d65de1de9cb330415c332a40d19",
"signature_version": "v1",
"digest": {
"length": 321.0,
"function_hash": "282506108123091286457195073191085585515"
}
}
]