DEBIAN-CVE-2024-39510

In the Linux kernel, the following vulnerability has been resolved: cachefiles: fix slab-use-after-free in cachefilesondemanddaemonread() We got the following issue in a fuzz test of randomly issuing the restore command: ================================================================== BUG: KASAN: slab-use-after-free in cachefilesondemanddaemonread+0xb41/0xb60 Read of size 8 at addr ffff888122e84088 by task ondemand-04-dae/963 CPU: 13 PID: 963 Comm: ondemand-04-dae Not tainted 6.8.0-dirty #564 Call Trace: kasanreport+0x93/0xc0 cachefilesondemanddaemonread+0xb41/0xb60 vfsread+0x169/0xb50 ksysread+0xf5/0x1e0 Allocated by task 116: kmemcachealloc+0x140/0x3a0 cachefileslookupcookie+0x140/0xcd0 fscachecookiestatemachine+0x43c/0x1230 [...] Freed by task 792: kmemcachefree+0xfe/0x390 cachefilesputobject+0x241/0x480 fscachecookiestatemachine+0x5c8/0x1230 [...] ================================================================== Following is the process that triggers the issue: mount | daemonthread1 | daemonthread2 ------------------------------------------------------------ cachefileswithdrawcookie cachefilesondemandcleanobject(object) cachefilesondemandsendreq REQA = kzalloc(sizeof(*req) + datalen) waitforcompletion(&REQA->done) cachefilesdaemonread cachefilesondemanddaemonread REQA = cachefilesondemandselectreq msg->objectid = req->object->ondemand->ondemandid ------ restore ------ cachefilesondemandrestore xasforeach(&xas, req, ULONGMAX) xassetmark(&xas, CACHEFILESREQNEW) cachefilesdaemonread cachefilesondemanddaemonread REQA = cachefilesondemandselectreq copytouser(buffer, msg, n) xaerase(&cache->reqs, id) complete(&REQA->done) ------ close(fd) ------ cachefilesondemandfdrelease cachefilesputobject cachefilesputobject kmemcachefree(cachefilesobjectjar, object) REQA->object->ondemand->ondemandid // object UAF !!! When we see the request within xalock, req->object must not have been freed yet, so grab the reference count of object before xaunlock to avoid the above issue.