PT-2024-5424 · Linux+4 · Linux Kernel+4

Baokun Li + 1 · Published 2024-06-21 · Updated 2025-02-03 · CVE-2024-40899

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.8.0-rc7-dirty #542

Description The issue is caused by a slab-use-after-free vulnerability in the cachefiles ondemand daemon read function. This occurs when a restore command is issued while the daemon is still alive, resulting in a request being processed multiple times and triggering a use-after-free (UAF) error. The vulnerability can be exploited by issuing a restore command when the daemon is still alive.

Technical details about exploitation include:

• The cachefiles ondemand get fd function is vulnerable to a UAF error.
• The REQ A variable is used to store a request, and its done field is waited on using wait for completion.
• The cachefiles ondemand daemon read function reads data from a file descriptor, and the copy to user function is used to copy data to a user-space buffer.
• The xas for each function is used to iterate over a set of requests, and the xas set mark function is used to set a mark on a request.
• The cachefiles ondemand restore function is used to restore a request, and the xa erase function is used to erase a request from a cache.

Recommendations To resolve the issue, add an additional reference count to cachefiles req, which is held while waiting and reading, and then released when the waiting and reading is over. As a temporary workaround, consider disabling the cachefiles ondemand daemon read function until a patch is available. Restrict access to the vulnerable cachefiles ondemand get fd function to minimize the risk of exploitation. Avoid using the REQ A variable in the affected API endpoint until the issue is resolved.

Exploit

Fix

Use After Free

Race Condition

Weakness Enumeration

CWE-416

CWE-362

Related Identifiers

BDU:2024-06068

CVE-2024-40899

DLA-4008-1

DSA-5731-1

SUSE-SU-2024:3194-1

SUSE-SU-2024:3195-1

SUSE-SU-2024:3383-1

SUSE-SU-2025:20044-1

SUSE-SU-2025:20047-1

USN-6999-1

USN-6999-2

USN-7004-1

USN-7005-1

USN-7005-2

USN-7008-1

USN-7029-1

Affected Products

Linuxmint

Linux Kernel

Red Os

Suse

Ubuntu

References · 1162

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/40xxx/CVE-2024-40899.json · Exploit
• https://ubuntu.com/security/CVE-2024-40957 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-40984 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-41002 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-40899 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-38780 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-38622 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-40921 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-39489 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7029-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-39500 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-40912 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-40949 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-38634 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-38306 · Vendor Advisory