CVE-2024-40900 cachefiles: remove requests from xarray during flushing requests
A use-after-free vulnerability in the Linux kernel's cachefiles subsystem allows attackers to execute arbitrary code or escalate privileges via race conditions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-40900?
CVE-2024-40900 is a high-severity use after free vulnerability in Linux kernel, published on 12 Jul 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
cachefiles: remove requests from xarray during flushing requests
Even with CACHEFILES_DEAD set, we can still read the requests, so in the following concurrency the request may be used after it has been freed:
mount | daemon_thread1 | daemon_thread2 ------------------------------------------------------------ cachefiles_ondemand_init_object cachefiles_ondemand_send_req REQ_A = kzalloc(sizeof(*req) + data_len) wait_for_completion(&REQ_A->done) cachefiles_daemon_read cachefiles_ondemand_daemon_read // close dev fd cachefiles_flush_reqs complete(&REQ_A->done) kfree(REQ_A) xa_lock(&cache->reqs); cachefiles_ondemand_select_req req->msg.opcode != CACHEFILES_OP_READ // req use-after-free !!! xa_unlock(&cache->reqs); xa_destroy(&cache->reqs)
Hence remove requests from cache->reqs when flushing them to avoid accessing freed requests.
Weakness: CWE-416
Which versions are affected by CVE-2024-40900?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-40900?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2024-40900 being exploited?
There is no known exploitation of CVE-2024-40900 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-40900, DEBIAN-CVE-2024-40900, GHSA-c93g-8734-9cr8, ROOT-OS-UBUNTU-2204-CVE-2024-40900, UBUNTU-CVE-2024-40900.