CVE-2024-41057— cachefiles: fix slab-use-after-free in cachefiles_withdraw_cookie()
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于在使用cachefiles_withdraw_cookie函数时，fscache_volume可能已经释放，但引用计数可能为0，导致释放后重用问题。
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of ServiceAffected Version Matrix 10
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | fe2140e2f57fef8562e0f9b7cd447d2b08dc2f35< 8de253177112a47c9af157d23ae934779188b4e1 |
affected |
fe2140e2f57fef8562e0f9b7cd447d2b08dc2f35< 9e67589a4a7b7e5660b524d1d5fe61242bcbcc11 |
affected | ||
fe2140e2f57fef8562e0f9b7cd447d2b08dc2f35< ef81340401e8a371d6b17f69e76d861920972cfe |
affected | ||
fe2140e2f57fef8562e0f9b7cd447d2b08dc2f35< 5d8f805789072ea7fd39504694b7bd17e5f751c4 |
affected | ||
5.17 |
affected | ||
< 5.17 |
unaffected | ||
6.1.101≤ 6.1.* |
unaffected | ||
6.6.42≤ 6.6.* |
unaffected | ||
| … +2 more rows | |||
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-41057
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
cachefiles: fix slab-use-after-free in cachefiles_withdraw_cookie()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
cachefiles: fix slab-use-after-free in cachefiles_withdraw_cookie()
We got the following issue in our fault injection stress test:
==================================================================
BUG: KASAN: slab-use-after-free in cachefiles_withdraw_cookie+0x4d9/0x600
Read of size 8 at addr ffff888118efc000 by task kworker/u78:0/109
CPU: 13 PID: 109 Comm: kworker/u78:0 Not tainted 6.8.0-dirty #566
Call Trace:
<TASK>
kasan_report+0x93/0xc0
cachefiles_withdraw_cookie+0x4d9/0x600
fscache_cookie_state_machine+0x5c8/0x1230
fscache_cookie_worker+0x91/0x1c0
process_one_work+0x7fa/0x1800
[...]
Allocated by task 117:
kmalloc_trace+0x1b3/0x3c0
cachefiles_acquire_volume+0xf3/0x9c0
fscache_create_volume_work+0x97/0x150
process_one_work+0x7fa/0x1800
[...]
Freed by task 120301:
kfree+0xf1/0x2c0
cachefiles_withdraw_cache+0x3fa/0x920
cachefiles_put_unbind_pincount+0x1f6/0x250
cachefiles_daemon_release+0x13b/0x290
__fput+0x204/0xa00
task_work_run+0x139/0x230
do_exit+0x87a/0x29b0
[...]
==================================================================
Following is the process that triggers the issue:
p1 | p2
------------------------------------------------------------
fscache_begin_lookup
fscache_begin_volume_access
fscache_cache_is_live(fscache_cache)
cachefiles_daemon_release
cachefiles_put_unbind_pincount
cachefiles_daemon_unbind
cachefiles_withdraw_cache
fscache_withdraw_cache
fscache_set_cache_state(cache, FSCACHE_CACHE_IS_WITHDRAWN);
cachefiles_withdraw_objects(cache)
fscache_wait_for_objects(fscache)
atomic_read(&fscache_cache->object_count) == 0
fscache_perform_lookup
cachefiles_lookup_cookie
cachefiles_alloc_object
refcount_set(&object->ref, 1);
object->volume = volume
fscache_count_object(vcookie->cache);
atomic_inc(&fscache_cache->object_count)
cachefiles_withdraw_volumes
cachefiles_withdraw_volume
fscache_withdraw_volume
__cachefiles_free_volume
kfree(cachefiles_volume)
fscache_cookie_state_machine
cachefiles_withdraw_cookie
cache = object->volume->cache;
// cachefiles_volume UAF !!!
After setting FSCACHE_CACHE_IS_WITHDRAWN, wait for all the cookie lookups
to complete first, and then wait for fscache_cache->object_count == 0 to
avoid the cookie exiting after the volume has been freed and triggering
the above issue. Therefore call fscache_withdraw_volume() before calling
cachefiles_withdraw_objects().
This way, after setting FSCACHE_CACHE_IS_WITHDRAWN, only the following two
cases will occur:
1) fscache_begin_lookup fails in fscache_begin_volume_access().
2) fscache_withdraw_volume() will ensure that fscache_count_object() has
been executed before calling fscache_wait_for_objects().
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于在使用cachefiles_withdraw_cookie函数时，fscache_volume可能已经释放，但引用计数可能为0，导致释放后重用问题。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2024-41057
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-41057
请登录查看更多情报信息。
Other References for CVE-2024-41057 (4)
Same Patch Batch · Linux · 2024-07-29 · 121 CVEs total
| CVE-2024-41040 | 9.8 CRITICAL | net/sched: Fix UAF when resolving a clash |
| CVE-2024-41073 | 9.8 CRITICAL | nvme: avoid double free special payload |
| CVE-2024-41081 | 9.8 CRITICAL | ila: block BH in ila_output() |
| CVE-2024-41091 | 8.8 HIGH | tun: add missing verification for short frame |
| CVE-2024-41090 | 8.8 HIGH | tap: add missing verification for short frame |
| CVE-2024-41062 | 8.8 HIGH | bluetooth/l2cap: sync sock recv cb and release |
| CVE-2024-41046 | 8.8 HIGH | net: ethernet: lantiq_etop: fix double free in detach |
| CVE-2024-42083 | 8.8 HIGH | ionic: fix kernel panic due to multi-buffer handling |
| CVE-2024-42064 | 7.8 HIGH | drm/amd/display: Skip pipe if the pipe idx not set properly |
| CVE-2024-41070 | 7.8 HIGH | KVM: PPC: Book3S HV: Prevent UAF in kvm_spapr_tce_attach_iommu_group() |
| CVE-2024-41041 | 7.8 HIGH | udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port(). |
| CVE-2024-41045 | 7.8 HIGH | bpf: Defer work in bpf_timer_cancel_and_free |
| CVE-2024-41049 | 7.8 HIGH | filelock: fix potential use-after-free in posix_lock_inode |
| CVE-2024-42066 | 7.8 HIGH | drm/xe: Fix potential integer overflow in page size calculation |
| CVE-2024-41051 | 7.8 HIGH | cachefiles: wait for ondemand_object_worker to finish when dropping object |
| CVE-2024-42072 | 7.8 HIGH | bpf: Fix may_goto with negative offset. |
| CVE-2024-42075 | 7.8 HIGH | bpf: Fix remap of arena. |
| CVE-2024-41064 | 7.8 HIGH | powerpc/eeh: avoid possible crash when edev->pdev changes |
| CVE-2024-41059 | 7.8 HIGH | hfsplus: fix uninit-value in copy_name |
| CVE-2024-42071 | 7.8 HIGH | ionic: use dev_consume_skb_any outside of napi |
Showing top 20 of 121 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-98164
KVM: x86/mmu: Check write tracking in all address spaces -
CVE-2026-98163
cgroup: Avoid iteration of dying tasks with zero refcount -
CVE-2026-98162
smb/server: fix tree connection leak in smb2_tree_connect() -
CVE-2026-98161
nvdimm: pmem: keep PREFLUSH before data writes -
CVE-2026-98160
staging: rtl8723bs: fix mismatched free of HalData in rtw_sd
Same vendor: Linux
-
CVE-2026-98164
KVM: x86/mmu: Check write tracking in all address spaces -
CVE-2026-98163
cgroup: Avoid iteration of dying tasks with zero refcount -
CVE-2026-98162
smb/server: fix tree connection leak in smb2_tree_connect() -
CVE-2026-98161
nvdimm: pmem: keep PREFLUSH before data writes -
CVE-2026-98160
staging: rtl8723bs: fix mismatched free of HalData in rtw_sd
V. Comments for CVE-2024-41057
No comments yet