CVE-2024-46786

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

fscache: delete fscache_cookie_lru_timer when fscache exits to avoid UAF

The fscache_cookie_lru_timer is initialized when the fscache module

is inserted, but is not deleted when the fscache module is removed.

If timer_reduce() is called before removing the fscache module,

the fscache_cookie_lru_timer will be added to the timer list of

the current cpu. Afterwards, a use-after-free will be triggered

in the softIRQ after removing the fscache module, as follows:

==================================================================

BUG: unable to handle page fault for address: fffffbfff803c9e9

PF: supervisor read access in kernel mode

PF: error_code(0x0000) - not-present page

PGD 21ffea067 P4D 21ffea067 PUD 21ffe6067 PMD 110a7c067 PTE 0

Oops: Oops: 0000 [#1] PREEMPT SMP KASAN PTI

CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: G W 6.11.0-rc3 #855

Tainted: [W]=WARN

RIP: 0010:__run_timer_base.part.0+0x254/0x8a0

Call Trace:

<

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References