Wind River Support Network

Description

In the Linux kernel, the following vulnerability has been resolved:cachefiles: wait for ondemand_object_worker to finish when dropping objectWhen queuing ondemand_object_worker() to re-open the object,cachefiles_object is not pinned. The cachefiles_object may be freed whenthe pending read request is completed intentionally and the relatederofs is umounted. If ondemand_object_worker() runs after the object isfreed, it will incur use-after-free problem as shown below.process A  processs B  process C  process Dcachefiles_ondemand_send_req()// send a read req X// wait for its completion           // close ondemand fd           cachefiles_ondemand_fd_release()           // set object as CLOSE                       cachefiles_ondemand_daemon_read()                       // set object as REOPENING                       queue_work(fscache_wq, &info->ondemand_work)                                // close /dev/cachefiles                                cachefiles_daemon_release                                cachefiles_flush_reqs                                complete(&req->done)// read req X is completed// umount the erofs fscachefiles_put_object()// object will be freedcachefiles_ondemand_deinit_obj_info()kmem_cache_free(object)                       // both info and object are freed                       ondemand_object_worker()When dropping an object, it is no longer necessary to reopen the object,so use cancel_work_sync() to cancel or wait for ondemand_object_worker()to finish.

CREATE(Triage):(User=admin) CVE-2024-41051 (https://nvd.nist.gov/vuln/detail/CVE-2024-41051)

CVEs

• CVE-2024-41051