CVE-2024-56549

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

cachefiles: Fix NULL pointer dereference in object->file

At present, the object->file has the NULL pointer dereference problem in

ondemand-mode. The root cause is that the allocated fd and object->file

lifetime are inconsistent, and the user-space invocation to anon_fd uses

object->file. Following is the process that triggers the issue:

[write fd] [umount]

cachefiles_ondemand_fd_write_iter

fscache_cookie_state_machine

cachefiles_withdraw_cookie

if (!file) return -ENOBUFS

cachefiles_clean_up_object

cachefiles_unmark_inode_in_use

fput(object->file)

object->file = NULL

// file NULL pointer dereference!

__cachefiles_write(..., file, ...)

Fix this issue by add an additional reference count to the object->file

before write/llseek, and decrement after it finished.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References