CVE-2024-41012

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

filelock: Remove locks reliably when fcntl/close race is detected

When fcntl_setlk() races with close(), it removes the created lock with

do_lock_file_wait().

However, LSMs can allow the first do_lock_file_wait() that created the lock

while denying the second do_lock_file_wait() that tries to remove the lock.

Separately, posix_lock_file() could also fail to

remove a lock due to GFP_KERNEL allocation failure (when splitting a range

in the middle).

After the bug has been triggered, use-after-free reads will occur in

lock_get_status() when userspace reads /proc/locks. This can likely be used

to read arbitrary kernel memory, but can't corrupt kernel memory.

Fix it by calling locks_remove_posix() instead, which is designed to

reliably get rid of POSIX locks associated with the given file and

files_struct and is also used by filp_flush().

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References