CVE-2024-40935

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

cachefiles: flush all requests after setting CACHEFILES_DEAD

In ondemand mode, when the daemon is processing an open request, if the

kernel flags the cache as CACHEFILES_DEAD, the cachefiles_daemon_write()

will always return -EIO, so the daemon can't pass the copen to the kernel.

Then the kernel process that is waiting for the copen triggers a hung_task.

Since the DEAD state is irreversible, it can only be exited by closing

/dev/cachefiles. Therefore, after calling cachefiles_io_error() to mark

the cache as CACHEFILES_DEAD, if in ondemand mode, flush all requests to

avoid the above hungtask. We may still be able to read some of the cached

data before closing the fd of /dev/cachefiles.

Note that this relies on the patch that adds reference counting to the req,

otherwise it may UAF.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References