CVE-2024-41075 (GCVE-0-2024-41075)
Vulnerability from cvelistv5
Published
2024-07-29 14:57
Modified
2026-08-05 11:35
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: cachefiles: add consistency check for copen/cread This prevents malicious processes from completing random copen/cread requests and crashing the system. Added checks are listed below: * Generic, copen can only complete open requests, and cread can only complete read requests. * For copen, ondemand_id must not be 0, because this indicates that the request has not been read by the daemon. * For cread, the object corresponding to fd and req should be the same.
References
Impacted products
Vendor Product Version
Linux Linux Version: 9032b6e8589f269743984aac53e82e4835be16dc
Version: 9032b6e8589f269743984aac53e82e4835be16dc
Version: 9032b6e8589f269743984aac53e82e4835be16dc
Version: 9032b6e8589f269743984aac53e82e4835be16dc
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:00:30.195Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3b744884c0431b5a62c92900e64bfd0ed61e8e2a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/36d845ccd7bf527110a65fe953886a176c209539"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8aaa6c5dd2940ab934d6cd296175f43dbb32b34a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a26dc49df37e996876f50a0210039b2d211fdd6f"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-41075",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:21:24.232426Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:00.106Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/cachefiles/ondemand.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3b744884c0431b5a62c92900e64bfd0ed61e8e2a",
              "status": "affected",
              "version": "9032b6e8589f269743984aac53e82e4835be16dc",
              "versionType": "git"
            },
            {
              "lessThan": "36d845ccd7bf527110a65fe953886a176c209539",
              "status": "affected",
              "version": "9032b6e8589f269743984aac53e82e4835be16dc",
              "versionType": "git"
            },
            {
              "lessThan": "8aaa6c5dd2940ab934d6cd296175f43dbb32b34a",
              "status": "affected",
              "version": "9032b6e8589f269743984aac53e82e4835be16dc",
              "versionType": "git"
            },
            {
              "lessThan": "a26dc49df37e996876f50a0210039b2d211fdd6f",
              "status": "affected",
              "version": "9032b6e8589f269743984aac53e82e4835be16dc",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/cachefiles/ondemand.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.19"
            },
            {
              "lessThan": "5.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.101",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.42",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.11",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncachefiles: add consistency check for copen/cread\n\nThis prevents malicious processes from completing random copen/cread\nrequests and crashing the system. Added checks are listed below:\n\n  * Generic, copen can only complete open requests, and cread can only\n    complete read requests.\n  * For copen, ondemand_id must not be 0, because this indicates that the\n    request has not been read by the daemon.\n  * For cread, the object corresponding to fd and req should be the same."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local access to issue `ioctl(CACHEFILES_IOC_READ_COMPLETE)` on the anonymous `[cachefiles]` file descriptor or `write()` the `copen` command to `/dev/cachefiles`. There is no network-facing path into `fs/cachefiles/ondemand.c`.\nAC:L - Request IDs are the lowest free xarray indices starting at 0, so they are trivially enumerable, and the attacker can generate requests on demand by reading files from the erofs-over-fscache mount, controlling both sides of any timing window. No condition outside the attacker\u0027s control is needed.\nPR:L - `cachefiles_ondemand_fd_ioctl()` performs no capability check at all \u2014 mere possession of the anon fd suffices \u2014 and that fd is created with `get_unused_fd_flags(O_WRONLY)` without `O_CLOEXEC`, so it is inherited across `exec()` and is routinely passed to unprivileged helper processes in on-demand cache/container-image deployments.\nUI:N - No victim action is required; the cachefiles daemon and the fscache/erofs mount are already-running system state, and the attacker itself generates the OPEN/READ requests it then maliciously completes.\nS:U - The corrupted request and object state, the truncation of backing cache files, and the resulting crashes all remain within the kernel\u0027s own security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - Completing a READ request out of band makes the netfs/erofs path treat an unpopulated range as successfully fetched, exposing raw backing cache-file contents (stale data from culled/reused cache objects) to the reader. The corrupted request/object lifetimes in this exact code region are the same class that produced KASAN slab-use-after-free reads in the sibling fixes.\nI:H - `copen` on an arbitrary request lets the attacker set any object\u0027s `cookie-\u003eobject_size`, which drives `vfs_truncate()` of the backing cache file and the on-disk coherency xattr, and lets erofs-over-fscache mounts serve wrong or unfetched content \u2014 corrupting data and executables read from container images.\nA:H - The commit exists specifically to stop malicious processes \"crashing the system\"; completing requests out of band leaves objects marked open with `ondemand_id == 0` and no anon fd, so readers block permanently in uninterruptible `wait_for_completion()` (hung task / unkillable D-state), and leaked anon fds pin cookies so later mounts hang as well."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:35:13.241Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3b744884c0431b5a62c92900e64bfd0ed61e8e2a"
        },
        {
          "url": "https://git.kernel.org/stable/c/36d845ccd7bf527110a65fe953886a176c209539"
        },
        {
          "url": "https://git.kernel.org/stable/c/8aaa6c5dd2940ab934d6cd296175f43dbb32b34a"
        },
        {
          "url": "https://git.kernel.org/stable/c/a26dc49df37e996876f50a0210039b2d211fdd6f"
        }
      ],
      "title": "cachefiles: add consistency check for copen/cread",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-41075",
    "datePublished": "2024-07-29T14:57:34.891Z",
    "dateReserved": "2024-07-12T12:17:45.632Z",
    "dateUpdated": "2026-08-05T11:35:13.241Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/3b744884c0431b5a62c92900e64bfd0ed61e8e2a\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/36d845ccd7bf527110a65fe953886a176c209539\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/8aaa6c5dd2940ab934d6cd296175f43dbb32b34a\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/a26dc49df37e996876f50a0210039b2d211fdd6f\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T04:46:52.518Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-41075\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T16:21:24.232426Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:20.092Z\"}}], \"cna\": {\"title\": \"cachefiles: add consistency check for copen/cread\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"9032b6e8589f269743984aac53e82e4835be16dc\", \"lessThan\": \"3b744884c0431b5a62c92900e64bfd0ed61e8e2a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9032b6e8589f269743984aac53e82e4835be16dc\", \"lessThan\": \"36d845ccd7bf527110a65fe953886a176c209539\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9032b6e8589f269743984aac53e82e4835be16dc\", \"lessThan\": \"8aaa6c5dd2940ab934d6cd296175f43dbb32b34a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9032b6e8589f269743984aac53e82e4835be16dc\", \"lessThan\": \"a26dc49df37e996876f50a0210039b2d211fdd6f\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/cachefiles/ondemand.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.19\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.19\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.101\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.42\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9.11\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/cachefiles/ondemand.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/3b744884c0431b5a62c92900e64bfd0ed61e8e2a\"}, {\"url\": \"https://git.kernel.org/stable/c/36d845ccd7bf527110a65fe953886a176c209539\"}, {\"url\": \"https://git.kernel.org/stable/c/8aaa6c5dd2940ab934d6cd296175f43dbb32b34a\"}, {\"url\": \"https://git.kernel.org/stable/c/a26dc49df37e996876f50a0210039b2d211fdd6f\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncachefiles: add consistency check for copen/cread\\n\\nThis prevents malicious processes from completing random copen/cread\\nrequests and crashing the system. Added checks are listed below:\\n\\n  * Generic, copen can only complete open requests, and cread can only\\n    complete read requests.\\n  * For copen, ondemand_id must not be 0, because this indicates that the\\n    request has not been read by the daemon.\\n  * For cread, the object corresponding to fd and req should be the same.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.101\", \"versionStartIncluding\": \"5.19\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.42\", \"versionStartIncluding\": \"5.19\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9.11\", \"versionStartIncluding\": \"5.19\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10\", \"versionStartIncluding\": \"5.19\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-21T09:12:55.086Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-41075\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-21T09:12:55.086Z\", \"dateReserved\": \"2024-07-12T12:17:45.632Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-07-29T14:57:34.891Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.