CVE-2024-41050

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

cachefiles: cyclic allocation of msg_id to avoid reuse

Reusing the msg_id after a maliciously completed reopen request may cause

a read request to remain unprocessed and result in a hung, as shown below:

t1 | t2 | t3

-------------------------------------------------

cachefiles_ondemand_select_req

cachefiles_ondemand_object_is_close(A)

cachefiles_ondemand_set_object_reopening(A)

queue_work(fscache_object_wq, &info->work)

ondemand_object_worker

cachefiles_ondemand_init_object(A)

cachefiles_ondemand_send_req(OPEN)

// get msg_id 6

wait_for_completion(&req_A->done)

cachefiles_ondemand_daemon_read

// read msg_id 6 req_A

cachefiles_ondemand_get_fd

copy_to_user

// Malicious completion msg_id 6

copen 6,-1

c

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References