Log in Start free

Vulnerability · Published Jul 12, 2024 · Assigned by Linux

CVE-2024-40913cachefiles: defer exposing anon_fd until after copy_to_user() succeeds

High 7.8

In plain English

A high-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)7.8High
Exploit odds (30 days)0.3%top 78.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: cachefiles: defer exposing anon_fd until after copy_to_user() succeeds After installing the anonymous fd, we can now see it in userland and close it. However, at this point we may not have gotten the reference count of the cache, but we will put it during colse fd, so this may cause a cache UAF. So grab the cache reference count before fd_install(). In addition, by kernel convention, fd is taken over by the user land after fd_install(), and the kernel should not call close_fd() after that, i.e., it should call fd_install() after everything is ready, thus fd_install() is called after copy_to_user() succeeds.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux6.1.99-1DEBIAN-CVE-2024-40913
Debian:12linux6.1.99-1DSA-5731-1
Debian:13linux6.9.7-1DEBIAN-CVE-2024-40913
Debian:14linux6.9.7-1DEBIAN-CVE-2024-40913
Ubuntu:24.04:LTSlinux6.8.0-44.44UBUNTU-CVE-2024-40913
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2024-40913
Ubuntu:24.04:LTSlinux-aws6.8.0-1015.16UBUNTU-CVE-2024-40913
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2024-40913
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2024-40913
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2024-40913
Ubuntu:22.04:LTSlinux-aws-6.86.8.0-1015.16~22.04.1UBUNTU-CVE-2024-40913
Ubuntu:24.04:LTSlinux-azure6.8.0-1014.16UBUNTU-CVE-2024-40913
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2024-40913
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2024-40913
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2024-40913
Ubuntu:22.04:LTSlinux-azure-6.86.8.0-1014.16~22.04.1UBUNTU-CVE-2024-40913
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2024-40913
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2024-40913
Ubuntu:24.04:LTSlinux-gcp6.8.0-1014.16UBUNTU-CVE-2024-40913
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2024-40913
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2024-40913
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2024-40913
Ubuntu:22.04:LTSlinux-gcp-6.86.8.0-1014.16~22.04.1UBUNTU-CVE-2024-40913
Ubuntu:24.04:LTSlinux-gke6.8.0-1010.13UBUNTU-CVE-2024-40913
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2024-40913
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2024-40913
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2024-40913
Ubuntu:22.04:LTSlinux-hwe-6.86.8.0-45.45~22.04.1UBUNTU-CVE-2024-40913
Ubuntu:24.04:LTSlinux-ibm6.8.0-1012.12UBUNTU-CVE-2024-40913
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2024-40913
Ubuntu:24.04:LTSlinux-lowlatency6.8.0-44.44.1UBUNTU-CVE-2024-40913
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2024-40913
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2024-40913
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2024-40913
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.86.8.0-44.44.1~22.04.1UBUNTU-CVE-2024-40913
Ubuntu:24.04:LTSlinux-nvidia6.8.0-1013.14UBUNTU-CVE-2024-40913
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2024-40913
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2024-40913
Ubuntu:22.04:LTSlinux-nvidia-6.86.8.0-1013.14~22.04.1UBUNTU-CVE-2024-40913
Ubuntu:24.04:LTSlinux-nvidia-lowlatency6.8.0-1013.14.1UBUNTU-CVE-2024-40913
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2024-40913
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2024-40913
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2024-40913
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2024-40913
Ubuntu:24.04:LTSlinux-oem-6.86.8.0-1012.12UBUNTU-CVE-2024-40913
Ubuntu:24.04:LTSlinux-oracle6.8.0-1012.12UBUNTU-CVE-2024-40913
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2024-40913
Ubuntu:22.04:LTSlinux-oracle-6.86.8.0-1012.12~22.04.1UBUNTU-CVE-2024-40913
Ubuntu:24.04:LTSlinux-raspi6.8.0-1011.12UBUNTU-CVE-2024-40913
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2024-40913
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2024-40913
Ubuntu:24.04:LTSlinux-riscv6.8.0-44.44.1UBUNTU-CVE-2024-40913
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2024-40913
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2024-40913
Ubuntu:22.04:LTSlinux-riscv-6.86.8.0-44.44.1~22.04.1UBUNTU-CVE-2024-40913
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2024-40913
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2024-40913
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2024-40913

Affected products (as reported)

VendorProductVersions
Linux Linux c8383054506c77b814489c09877b5db83fd4abf2 – before eac51d9daacd61dcc93333ff6a890cf3efc8c1c0c8383054506c77b814489c09877b5db83fd4abf2 – before d2d3eb377a5d081bf2bed177d354a4f59b74da88c8383054506c77b814489c09877b5db83fd4abf2 – before b9f58cdae6a364a3270fd6b6a46e0fd4f7f8ce32c8383054506c77b814489c09877b5db83fd4abf2 – before 4b4391e77a6bf24cba2ef1590e113d9b73b11039
Linux Linux 5.19

References