CVE-2024-40899 cachefiles: fix slab-use-after-free in cachefiles_ondemand_get_fd()

In the Linux kernel, the following vulnerability has been resolved: cachefiles: fix slab-use-after-free in cachefilesondemandgetfd We got the following issue in a fuzz test of randomly issuing the restore command: ================================================================== BUG: KASAN:...

CVE-2024-40899

CVE-2024-40899 is a Linux kernel vulnerability in the cachefiles subsystem, causing a slab-use-after-free in cachefiles_ondemand_get_fd via a restore-triggered path that can lead to use-after-free in cachefiles_ondemand_daemon_read. The connected documents identify the issue as resolved by a patc...

CVE-2024-40899 cachefiles: fix slab-use-after-free in cachefiles_ondemand_get_fd()

In the Linux kernel, the following vulnerability has been resolved: cachefiles: fix slab-use-after-free in cachefilesondemandgetfd We got the following issue in a fuzz test of randomly issuing the restore command: ================================================================== BUG: KASAN:...

CVE-2024-39510 cachefiles: fix slab-use-after-free in cachefiles_ondemand_daemon_read()

In the Linux kernel, the following vulnerability has been resolved: cachefiles: fix slab-use-after-free in cachefilesondemanddaemonread We got the following issue in a fuzz test of randomly issuing the restore command: ================================================================== BUG: KASAN:...

Linux kernel security vulnerabilities

Linux kernel is the kernel used by the Linux Foundation's open source operating system Linux. A security vulnerability exists in the Linux kernel, which stems from a post-release reuse issue in the cachefiles component in the cachefilesondemanddaemonread function...

Linux kernel security vulnerabilities

Linux kernel is the kernel used by the Linux Foundation's open source operating system Linux. A security vulnerability exists in the Linux kernel that stems from a post-release reuse issue in the cachefiles component in the cachefilesondemandgetfd function...

Linux kernel security vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a failure of the cachefiles component to remove requests from the xarray when refreshing them, which could...

Linux kernel security vulnerabilities

Linux kernel is the kernel used by the Linux Foundation's open source operating system Linux. A security vulnerability exists in the Linux kernel that stems from a failure of the cachefiles component to properly delay exposing anonymous file descriptors after a successful copytouser function...

Linux kernel security vulnerabilities

Linux kernel is the kernel used by the Linux Foundation's open source operating system Linux. A security vulnerability exists in the Linux kernel that stems from a failure of the cachefiles component to properly refresh all requests after setting CACHEFILESDEAD...

CVE-2024-40935: Use After Free

In the Linux kernel, the following vulnerability has been resolved: cachefiles: flush all requests after setting CACHEFILESDEAD In ondemand mode, when the daemon is processing an open request, if the kernel flags the cache as CACHEFILESDEAD, the cachefilesdaemonwrite will always return -EIO, so t...

CVE-2024-40913: Use After Free

In the Linux kernel, the following vulnerability has been resolved: cachefiles: defer exposing anonfd until after copytouser succeeds After installing the anonymous fd, we can now see it in userland and close it. However, at this point we may not have gotten the reference count of the cache, but ...

CVE-2024-40900: Use After Free

In the Linux kernel, the following vulnerability has been resolved: cachefiles: remove requests from xarray during flushing requests Even with CACHEFILESDEAD set, we can still read the requests, so in the following concurrency the request may be used after it has been freed: mount | daemonthread1...

CVE-2024-40899: Use After Free

In the Linux kernel, the following vulnerability has been resolved: cachefiles: fix slab-use-after-free in cachefilesondemandgetfd We got the following issue in a fuzz test of randomly issuing the restore command: ================================================================== BUG: KASAN:...

CVE-2024-39510: Use After Free

In the Linux kernel, the following vulnerability has been resolved: cachefiles: fix slab-use-after-free in cachefilesondemanddaemonread We got the following issue in a fuzz test of randomly issuing the restore command: ================================================================== BUG: KASAN:...

PT-2024-7056

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.43 Description The vulnerability is related to a slab-use-after-free issue in the cachefiles withdraw cookie function. This issue can be triggered by a race condition between the cachefiles daemon release and...

PT-2024-29229

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The vulnerability is related to the cachefiles function in the Linux kernel, where the reuse of msg id after a maliciously completed reopen request can cause a read request to remain...

PT-2024-29230

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to the use of memory after it has been freed in the cachefiles function of the Linux kernel. This can lead to a use-after-free problem when the ondemand object worke...

CLSA-2024-1718973794 Fix of 21 CVEs

CVE-url: https://ubuntu.com/security/CVE-2024-26777 - fbdev: sis: Error out if pixclock equals zero CVE-url: https://ubuntu.com/security/CVE-2021-47542 - net: qlogic: qlcnic: Fix a NULL pointer dereference in qlcnic83xxaddrings CVE-url: https://ubuntu.com/security/CVE-2021-47518 - nfc: fix...

CLSA-2024-1718973513 Fix of 21 CVEs

CVE-url: https://ubuntu.com/security/CVE-2024-26777 - fbdev: sis: Error out if pixclock equals zero CVE-url: https://ubuntu.com/security/CVE-2021-47542 - net: qlogic: qlcnic: Fix a NULL pointer dereference in qlcnic83xxaddrings CVE-url: https://ubuntu.com/security/CVE-2021-47518 - nfc: fix...

CLSA-2024-1718950656 Fix of 22 CVEs

CVE-url: https://ubuntu.com/security/CVE-2024-26764 - aio: remove an outdated BUGON and comment in aiocomplete - aio: remove the extra getfile/fput pair in iosubmitone - aio: refactor read/write iocb setup - fs/aio: Restrict kiocbsetcancelfn to I/O submitted via libaio CVE-url:...