Wind River Support Network

Description

In the Linux kernel, the following vulnerability has been resolved:cachefiles: fix slab-use-after-free in cachefiles_withdraw_cookie()We got the following issue in our fault injection stress test:==================================================================BUG: KASAN: slab-use-after-free in cachefiles_withdraw_cookie+0x4d9/0x600Read of size 8 at addr ffff888118efc000 by task kworker/u78:0/109CPU: 13 PID: 109 Comm: kworker/u78:0 Not tainted 6.8.0-dirty #566Call Trace: <TASK> kasan_report+0x93/0xc0 cachefiles_withdraw_cookie+0x4d9/0x600 fscache_cookie_state_machine+0x5c8/0x1230 fscache_cookie_worker+0x91/0x1c0 process_one_work+0x7fa/0x1800 ...]Allocated by task 117: kmalloc_trace+0x1b3/0x3c0 cachefiles_acquire_volume+0xf3/0x9c0 fscache_create_volume_work+0x97/0x150 process_one_work+0x7fa/0x1800 [...]Freed by task 120301: kfree+0xf1/0x2c0 cachefiles_withdraw_cache+0x3fa/0x920 cachefiles_put_unbind_pincount+0x1f6/0x250 cachefiles_daemon_release+0x13b/0x290 __fput+0x204/0xa00 task_work_run+0x139/0x230 do_exit+0x87a/0x29b0 [...]==================================================================Following is the process that triggers the issue:           p1                 (             p2------------------------------------------------------------                              fscache_begin_lookup                               fscache_begin_volume_access                                fscache_cache_is_live(fscache_cache)cachefiles_daemon_release cachefiles_put_unbind_pincount  cachefiles_daemon_unbind   cachefiles_withdraw_cache    fscache_withdraw_cache     fscache_set_cache_state(cache, FSCACHE_CACHE_IS_WITHDRAWN);    cachefiles_withdraw_objects(cache)    fscache_wait_for_objects(fscache)      atomic_read(&fscache_cache->object_count) == 0                              fscache_perform_lookup                               cachefiles_lookup_cookie                                cachefiles_alloc_object                                 refcount_set(&object->ref, 1);                                 object->volume = volume                                 fscache_count_object(vcookie->cache);                                  atomic_inc(&fscache_cache->object_count)    cachefiles_withdraw_volumes     cachefiles_withdraw_volume      fscache_withdraw_volume      __cachefiles_free_volume       kfree(cachefiles_volume)                              fscache_cookie_state_machine                               cachefiles_withdraw_cookie                                cache = object->volume->cache;                                // cachefiles_volume UAF !!!After setting FSCACHE_CACHE_IS_WITHDRAWN, wait for all the cookie lookupsto complete first, and then wait for fscache_cache->object_count == 0 toavoid the cookie exiting after the volume has been freed and triggeringthe above issue. Therefore call fscache_withdraw_volume() before callingcachefiles_withdraw_objects().This way, after setting FSCACHE_CACHE_IS_WITHDRAWN, only the following twocases will occur:1) fscache_begin_lookup fails in fscache_begin_volume_access().2) fscache_withdraw_volume() will ensure that fscache_count_object() has   been executed before calling fscache_wait_for_objects().


CREATE(Triage):(User=admin) [CVE-2024-41057|https://nvd.nist.gov/vuln/detail/CVE-2024-41057)

CVEs

• CVE-2024-41057