CVE-2024-56549

In the Linux kernel, the following vulnerability has been resolved:

cachefiles: Fix NULL pointer dereference in object->file

At present, the object->file has the NULL pointer dereference problem in ondemand-mode. The root cause is that the allocated fd and object->file lifetime are inconsistent, and the user-space invocation to anon_fd uses object->file. Following is the process that triggers the issue:

  [write fd]				[umount]

cachefiles_ondemand_fd_write_iter fscache_cookie_state_machine cachefiles_withdraw_cookie if (!file) return -ENOBUFS cachefiles_clean_up_object cachefiles_unmark_inode_in_use fput(object->file) object->file = NULL // file NULL pointer dereference! __cachefiles_write(..., file, ...)

Fix this issue by add an additional reference count to the object->file before write/llseek, and decrement after it finished.

A low impact NULL pointer dereference flaw was found in the Linux kernel cachefiles on-demand read (ondemand-mode) support shipped in Red Hat Enterprise Linux 9. When a user-space write to the anonymous file descriptor (anon_fd) races with an unmount, the fscache cookie withdrawal path cleans up the cache object and sets object->file to NULL while the write path still uses it in __cachefiles_write(), leading to a kernel panic and local denial of service. Exploiting this requires local access on a system where cachefiles on-demand mode is in use. The affected code was introduced upstream in Linux 5.19, so Red Hat Enterprise Linux 8, whose kernel predates that introduction, is not affected; Hosted OpenShift (ARO/OSD) environments are also not affected, and Red Hat Enterprise Linux 6 and 7 are out of support scope. For the affected Red Hat Enterprise Linux 9 kernel and kernel-rt streams the fix is deferred, given the low impact and the narrow race conditions required to trigger it; the residual risk remains a local denial of service. Red Hat scores this flaw CVSS 5.5 (Moderate, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), lower than the CVE.org rating of Important (7.8), because the NULL pointer dereference only affects availability and there is no evidence of any confidentiality or integrity impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.