CVE-2024-39510

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> cachefiles: fix slab-use-after-free in cachefiles_ondemand_daemon_read()<br /> <br /> We got the following issue in a fuzz test of randomly issuing the restore<br /> command:<br /> <br /> ==================================================================<br /> BUG: KASAN: slab-use-after-free in cachefiles_ondemand_daemon_read+0xb41/0xb60<br /> Read of size 8 at addr ffff888122e84088 by task ondemand-04-dae/963<br /> <br /> CPU: 13 PID: 963 Comm: ondemand-04-dae Not tainted 6.8.0-dirty #564<br /> Call Trace:<br /> kasan_report+0x93/0xc0<br /> cachefiles_ondemand_daemon_read+0xb41/0xb60<br /> vfs_read+0x169/0xb50<br /> ksys_read+0xf5/0x1e0<br /> <br /> Allocated by task 116:<br /> kmem_cache_alloc+0x140/0x3a0<br /> cachefiles_lookup_cookie+0x140/0xcd0<br /> fscache_cookie_state_machine+0x43c/0x1230<br /> [...]<br /> <br /> Freed by task 792:<br /> kmem_cache_free+0xfe/0x390<br /> cachefiles_put_object+0x241/0x480<br /> fscache_cookie_state_machine+0x5c8/0x1230<br /> [...]<br /> ==================================================================<br /> <br /> Following is the process that triggers the issue:<br /> <br /> mount | daemon_thread1 | daemon_thread2<br /> ------------------------------------------------------------<br /> cachefiles_withdraw_cookie<br /> cachefiles_ondemand_clean_object(object)<br /> cachefiles_ondemand_send_req<br /> REQ_A = kzalloc(sizeof(*req) + data_len)<br /> wait_for_completion(&amp;REQ_A-&gt;done)<br /> <br /> cachefiles_daemon_read<br /> cachefiles_ondemand_daemon_read<br /> REQ_A = cachefiles_ondemand_select_req<br /> msg-&gt;object_id = req-&gt;object-&gt;ondemand-&gt;ondemand_id<br /> ------ restore ------<br /> cachefiles_ondemand_restore<br /> xas_for_each(&amp;xas, req, ULONG_MAX)<br /> xas_set_mark(&amp;xas, CACHEFILES_REQ_NEW)<br /> <br /> cachefiles_daemon_read<br /> cachefiles_ondemand_daemon_read<br /> REQ_A = cachefiles_ondemand_select_req<br /> copy_to_user(_buffer, msg, n)<br /> xa_erase(&amp;cache-&gt;reqs, id)<br /> complete(&amp;REQ_A-&gt;done)<br /> ------ close(fd) ------<br /> cachefiles_ondemand_fd_release<br /> cachefiles_put_object<br /> cachefiles_put_object<br /> kmem_cache_free(cachefiles_object_jar, object)<br /> REQ_A-&gt;object-&gt;ondemand-&gt;ondemand_id<br /> // object UAF !!!<br /> <br /> When we see the request within xa_lock, req-&gt;object must not have been<br /> freed yet, so grab the reference count of object before xa_unlock to<br /> avoid the above issue.