{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-41075", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-07-12T12:17:45.632Z", "datePublished": "2024-07-29T14:57:34.891Z", "dateUpdated": "2026-08-05T11:35:13.241Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:35:13.241Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncachefiles: add consistency check for copen/cread\n\nThis prevents malicious processes from completing random copen/cread\nrequests and crashing the system. Added checks are listed below:\n\n * Generic, copen can only complete open requests, and cread can only\n complete read requests.\n * For copen, ondemand_id must not be 0, because this indicates that the\n request has not been read by the daemon.\n * For cread, the object corresponding to fd and req should be the same." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - Exploitation requires local access to issue `ioctl(CACHEFILES_IOC_READ_COMPLETE)` on the anonymous `[cachefiles]` file descriptor or `write()` the `copen` command to `/dev/cachefiles`. There is no network-facing path into `fs/cachefiles/ondemand.c`.\nAC:L - Request IDs are the lowest free xarray indices starting at 0, so they are trivially enumerable, and the attacker can generate requests on demand by reading files from the erofs-over-fscache mount, controlling both sides of any timing window. No condition outside the attacker's control is needed.\nPR:L - `cachefiles_ondemand_fd_ioctl()` performs no capability check at all — mere possession of the anon fd suffices — and that fd is created with `get_unused_fd_flags(O_WRONLY)` without `O_CLOEXEC`, so it is inherited across `exec()` and is routinely passed to unprivileged helper processes in on-demand cache/container-image deployments.\nUI:N - No victim action is required; the cachefiles daemon and the fscache/erofs mount are already-running system state, and the attacker itself generates the OPEN/READ requests it then maliciously completes.\nS:U - The corrupted request and object state, the truncation of backing cache files, and the resulting crashes all remain within the kernel's own security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - Completing a READ request out of band makes the netfs/erofs path treat an unpopulated range as successfully fetched, exposing raw backing cache-file contents (stale data from culled/reused cache objects) to the reader. The corrupted request/object lifetimes in this exact code region are the same class that produced KASAN slab-use-after-free reads in the sibling fixes.\nI:H - `copen` on an arbitrary request lets the attacker set any object's `cookie->object_size`, which drives `vfs_truncate()` of the backing cache file and the on-disk coherency xattr, and lets erofs-over-fscache mounts serve wrong or unfetched content — corrupting data and executables read from container images.\nA:H - The commit exists specifically to stop malicious processes \"crashing the system\"; completing requests out of band leaves objects marked open with `ondemand_id == 0` and no anon fd, so readers block permanently in uninterruptible `wait_for_completion()` (hung task / unkillable D-state), and leaked anon fds pin cookies so later mounts hang as well." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/cachefiles/ondemand.c" ], "versions": [ { "version": "9032b6e8589f269743984aac53e82e4835be16dc", "lessThan": "3b744884c0431b5a62c92900e64bfd0ed61e8e2a", "status": "affected", "versionType": "git" }, { "version": "9032b6e8589f269743984aac53e82e4835be16dc", "lessThan": "36d845ccd7bf527110a65fe953886a176c209539", "status": "affected", "versionType": "git" }, { "version": "9032b6e8589f269743984aac53e82e4835be16dc", "lessThan": "8aaa6c5dd2940ab934d6cd296175f43dbb32b34a", "status": "affected", "versionType": "git" }, { "version": "9032b6e8589f269743984aac53e82e4835be16dc", "lessThan": "a26dc49df37e996876f50a0210039b2d211fdd6f", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/cachefiles/ondemand.c" ], "versions": [ { "version": "5.19", "status": "affected" }, { "version": "0", "lessThan": "5.19", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.101", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.42", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.9.11", "lessThanOrEqual": "6.9.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.10", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.1.101" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.6.42" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.9.11" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.10" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/3b744884c0431b5a62c92900e64bfd0ed61e8e2a" }, { "url": "https://git.kernel.org/stable/c/36d845ccd7bf527110a65fe953886a176c209539" }, { "url": "https://git.kernel.org/stable/c/8aaa6c5dd2940ab934d6cd296175f43dbb32b34a" }, { "url": "https://git.kernel.org/stable/c/a26dc49df37e996876f50a0210039b2d211fdd6f" } ], "title": "cachefiles: add consistency check for copen/cread", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/3b744884c0431b5a62c92900e64bfd0ed61e8e2a", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/36d845ccd7bf527110a65fe953886a176c209539", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/8aaa6c5dd2940ab934d6cd296175f43dbb32b34a", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/a26dc49df37e996876f50a0210039b2d211fdd6f", "tags": [ "x_transferred" ] }, { "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:00:30.195Z" } }, { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2024-41075", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-09-10T16:21:24.232426Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:34:00.106Z" } } ] } }