CVE-2024-40935

In the Linux kernel, the following vulnerability has been resolved:

cachefiles: flush all requests after setting CACHEFILES_DEAD

In ondemand mode, when the daemon is processing an open request, if the kernel flags the cache as CACHEFILES_DEAD, the cachefiles_daemon_write() will always return -EIO, so the daemon cant pass the copen to the kernel. Then the kernel process that is waiting for the copen triggers a hung_task.

Since the DEAD state is irreversible, it can only be exited by closing /dev/cachefiles. Therefore, after calling cachefiles_io_error() to mark the cache as CACHEFILES_DEAD, if in ondemand mode, flush all requests to avoid the above hungtask. We may still be able to read some of the cached data before closing the fd of /dev/cachefiles.

Note that this relies on the patch that adds reference counting to the req, otherwise it may UAF.

Weakness

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory “belongs” to the code that operates on the new pointer.

Affected Software

Potential Mitigations

References

• https://git.kernel.org/stable/c/320ba9cbca78be79c912143bbba1d1b35ca55cf0
• https://git.kernel.org/stable/c/3bf0b8030296e9ee60d3d4c15849ad9ac0b47081
• https://git.kernel.org/stable/c/85e833cd7243bda7285492b0653c3abb1e2e757b
• https://git.kernel.org/stable/c/e73fac95084839c5178d97e81c6a2051251bdc00
• https://git.kernel.org/stable/c/320ba9cbca78be79c912143bbba1d1b35ca55cf0
• https://git.kernel.org/stable/c/3bf0b8030296e9ee60d3d4c15849ad9ac0b47081
• https://git.kernel.org/stable/c/85e833cd7243bda7285492b0653c3abb1e2e757b
• https://git.kernel.org/stable/c/e73fac95084839c5178d97e81c6a2051251bdc00
• https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html