CVE-2024-40900

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

cachefiles: remove requests from xarray during flushing requests

Even with CACHEFILES_DEAD set, we can still read the requests, so in the

following concurrency the request may be used after it has been freed:

mount | daemon_thread1 | daemon_thread2

------------------------------------------------------------

cachefiles_ondemand_init_object

cachefiles_ondemand_send_req

REQ_A = kzalloc(sizeof(*req) + data_len)

wait_for_completion(&REQ_A->done)

cachefiles_daemon_read

cachefiles_ondemand_daemon_read

// close dev fd

cachefiles_flush_reqs

complete(&REQ_A->done)

kfree(REQ_A)

xa_lock(&cache->reqs);

cachefiles_ondemand_select_req

req->msg.opcode != CACHEFILES_OP_READ

// req use-after-free !!!

xa_unloc

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References