{
  "threat_severity" : "Moderate",
  "public_date" : "2024-07-29T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: cachefiles: fix slab-use-after-free in fscache_withdraw_volume()",
    "id" : "2300432",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2300432"
  },
  "cvss3" : {
    "cvss3_base_score" : "7.0",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-416",
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\ncachefiles: fix slab-use-after-free in fscache_withdraw_volume()\nWe got the following issue in our fault injection stress test:\n==================================================================\nBUG: KASAN: slab-use-after-free in fscache_withdraw_volume+0x2e1/0x370\nRead of size 4 at addr ffff88810680be08 by task ondemand-04-dae/5798\nCPU: 0 PID: 5798 Comm: ondemand-04-dae Not tainted 6.8.0-dirty #565\nCall Trace:\nkasan_check_range+0xf6/0x1b0\nfscache_withdraw_volume+0x2e1/0x370\ncachefiles_withdraw_volume+0x31/0x50\ncachefiles_withdraw_cache+0x3ad/0x900\ncachefiles_put_unbind_pincount+0x1f6/0x250\ncachefiles_daemon_release+0x13b/0x290\n__fput+0x204/0xa00\ntask_work_run+0x139/0x230\nAllocated by task 5820:\n__kmalloc+0x1df/0x4b0\nfscache_alloc_volume+0x70/0x600\n__fscache_acquire_volume+0x1c/0x610\nerofs_fscache_register_volume+0x96/0x1a0\nerofs_fscache_register_fs+0x49a/0x690\nerofs_fc_fill_super+0x6c0/0xcc0\nvfs_get_super+0xa9/0x140\nvfs_get_tree+0x8e/0x300\ndo_new_mount+0x28c/0x580\n[...]\nFreed by task 5820:\nkfree+0xf1/0x2c0\nfscache_put_volume.part.0+0x5cb/0x9e0\nerofs_fscache_unregister_fs+0x157/0x1b0\nerofs_kill_sb+0xd9/0x1c0\ndeactivate_locked_super+0xa3/0x100\nvfs_get_super+0x105/0x140\nvfs_get_tree+0x8e/0x300\ndo_new_mount+0x28c/0x580\n[...]\n==================================================================\nFollowing is the process that triggers the issue:\nmount failed         |         daemon exit\n------------------------------------------------------------\ndeactivate_locked_super        cachefiles_daemon_release\nerofs_kill_sb\nerofs_fscache_unregister_fs\nfscache_relinquish_volume\n__fscache_relinquish_volume\nfscache_put_volume(fscache_volume, fscache_volume_put_relinquish)\nzero = __refcount_dec_and_test(&fscache_volume->ref, &ref);\ncachefiles_put_unbind_pincount\ncachefiles_daemon_unbind\ncachefiles_withdraw_cache\ncachefiles_withdraw_volumes\nlist_del_init(&volume->cache_link)\nfscache_free_volume(fscache_volume)\ncache->ops->free_volume\ncachefiles_free_volume\nlist_del_init(&cachefiles_volume->cache_link);\nkfree(fscache_volume)\ncachefiles_withdraw_volume\nfscache_withdraw_volume\nfscache_volume->n_accesses\n// fscache_volume UAF !!!\nThe fscache_volume in cache->volumes must not have been freed yet, but its\nreference count may be 0. So use the new fscache_try_get_volume() helper\nfunction try to get its reference count.\nIf the reference count of fscache_volume is 0, fscache_put_volume() is\nfreeing it, so wait for it to be removed from cache->volumes.\nIf its reference count is not 0, call cachefiles_withdraw_volume() with\nreference count protection to avoid the above issue.", "A slab-use-after-free was found in fscache_withdraw_volume() in the Linux kernel." ],
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2024-11-12T00:00:00Z",
    "advisory" : "RHSA-2024:9315",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-503.11.1.el9_5"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2024-11-12T00:00:00Z",
    "advisory" : "RHSA-2024:9315",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-503.11.1.el9_5"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Out of support scope",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Out of support scope",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Out of support scope",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2024-41058\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-41058\nhttps://lore.kernel.org/linux-cve-announce/2024072905-CVE-2024-41058-4593@gregkh/T" ],
  "name" : "CVE-2024-41058",
  "csaw" : false
}