CVE-2024-41051

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

cachefiles: wait for ondemand_object_worker to finish when dropping object

When queuing ondemand_object_worker() to re-open the object,

cachefiles_object is not pinned. The cachefiles_object may be freed when

the pending read request is completed intentionally and the related

erofs is umounted. If ondemand_object_worker() runs after the object is

freed, it will incur use-after-free problem as shown below.

process A processs B process C process D

cachefiles_ondemand_send_req()

// send a read req X

// wait for its completion

// close ondemand fd

cachefiles_ondemand_fd_release()

// set object as CLOSE

cachefiles_ondemand_daemon_read()

// set object as REOPENING

queue_work(fscache_wq, &info->ondemand_work)

// close /dev/cachefiles

cachefiles_daemon_r

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References