GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-39510 (GCVE-0-2024-39510)

Vulnerability from cvelistv5 – Published: 2024-07-12 12:20 – Updated: 2026-05-11 20:21
VLAI
Title
cachefiles: fix slab-use-after-free in cachefiles_ondemand_daemon_read()
Summary
In the Linux kernel, the following vulnerability has been resolved: cachefiles: fix slab-use-after-free in cachefiles_ondemand_daemon_read() We got the following issue in a fuzz test of randomly issuing the restore command: ================================================================== BUG: KASAN: slab-use-after-free in cachefiles_ondemand_daemon_read+0xb41/0xb60 Read of size 8 at addr ffff888122e84088 by task ondemand-04-dae/963 CPU: 13 PID: 963 Comm: ondemand-04-dae Not tainted 6.8.0-dirty #564 Call Trace: kasan_report+0x93/0xc0 cachefiles_ondemand_daemon_read+0xb41/0xb60 vfs_read+0x169/0xb50 ksys_read+0xf5/0x1e0 Allocated by task 116: kmem_cache_alloc+0x140/0x3a0 cachefiles_lookup_cookie+0x140/0xcd0 fscache_cookie_state_machine+0x43c/0x1230 [...] Freed by task 792: kmem_cache_free+0xfe/0x390 cachefiles_put_object+0x241/0x480 fscache_cookie_state_machine+0x5c8/0x1230 [...] ================================================================== Following is the process that triggers the issue: mount | daemon_thread1 | daemon_thread2 ------------------------------------------------------------ cachefiles_withdraw_cookie cachefiles_ondemand_clean_object(object) cachefiles_ondemand_send_req REQ_A = kzalloc(sizeof(*req) + data_len) wait_for_completion(&REQ_A->done) cachefiles_daemon_read cachefiles_ondemand_daemon_read REQ_A = cachefiles_ondemand_select_req msg->object_id = req->object->ondemand->ondemand_id ------ restore ------ cachefiles_ondemand_restore xas_for_each(&xas, req, ULONG_MAX) xas_set_mark(&xas, CACHEFILES_REQ_NEW) cachefiles_daemon_read cachefiles_ondemand_daemon_read REQ_A = cachefiles_ondemand_select_req copy_to_user(_buffer, msg, n) xa_erase(&cache->reqs, id) complete(&REQ_A->done) ------ close(fd) ------ cachefiles_ondemand_fd_release cachefiles_put_object cachefiles_put_object kmem_cache_free(cachefiles_object_jar, object) REQ_A->object->ondemand->ondemand_id // object UAF !!! When we see the request within xa_lock, req->object must not have been freed yet, so grab the reference count of object before xa_unlock to avoid the above issue.
Severity
No CVSS data available.
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 17:06 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: f17443d52d805c9a7fab5e67a4e8b973626fe1cd , < cb55625f8eb9d2de8be4da0c4580d48cbb32058e (git)
Affected: f740fd943bb1fbf79b7eaba3c71eb7536f437f51 , < 3958679c49152391209b32be3357193300a51abd (git)
Affected: 0a7e54c1959c0feb2de23397ec09c7692364313e , < 93064676a2820420a2d37d7c8289f277fe20793d (git)
Affected: 0a7e54c1959c0feb2de23397ec09c7692364313e , < da4a827416066191aafeeccee50a8836a826ba10 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.8
Unaffected: 0 , < 6.8 (semver)
Unaffected: 6.9.6 , ≤ 6.9.* (semver)
Unaffected: 6.10 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T21:56:30.908Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/cb55625f8eb9d2de8be4da0c4580d48cbb32058e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3958679c49152391209b32be3357193300a51abd"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/93064676a2820420a2d37d7c8289f277fe20793d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/da4a827416066191aafeeccee50a8836a826ba10"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-39510",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:06:40.868593Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:38.916Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/cachefiles/ondemand.c",
            "include/trace/events/cachefiles.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cb55625f8eb9d2de8be4da0c4580d48cbb32058e",
              "status": "affected",
              "version": "f17443d52d805c9a7fab5e67a4e8b973626fe1cd",
              "versionType": "git"
            },
            {
              "lessThan": "3958679c49152391209b32be3357193300a51abd",
              "status": "affected",
              "version": "f740fd943bb1fbf79b7eaba3c71eb7536f437f51",
              "versionType": "git"
            },
            {
              "lessThan": "93064676a2820420a2d37d7c8289f277fe20793d",
              "status": "affected",
              "version": "0a7e54c1959c0feb2de23397ec09c7692364313e",
              "versionType": "git"
            },
            {
              "lessThan": "da4a827416066191aafeeccee50a8836a826ba10",
              "status": "affected",
              "version": "0a7e54c1959c0feb2de23397ec09c7692364313e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/cachefiles/ondemand.c",
            "include/trace/events/cachefiles.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.6",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncachefiles: fix slab-use-after-free in cachefiles_ondemand_daemon_read()\n\nWe got the following issue in a fuzz test of randomly issuing the restore\ncommand:\n\n==================================================================\nBUG: KASAN: slab-use-after-free in cachefiles_ondemand_daemon_read+0xb41/0xb60\nRead of size 8 at addr ffff888122e84088 by task ondemand-04-dae/963\n\nCPU: 13 PID: 963 Comm: ondemand-04-dae Not tainted 6.8.0-dirty #564\nCall Trace:\n kasan_report+0x93/0xc0\n cachefiles_ondemand_daemon_read+0xb41/0xb60\n vfs_read+0x169/0xb50\n ksys_read+0xf5/0x1e0\n\nAllocated by task 116:\n kmem_cache_alloc+0x140/0x3a0\n cachefiles_lookup_cookie+0x140/0xcd0\n fscache_cookie_state_machine+0x43c/0x1230\n [...]\n\nFreed by task 792:\n kmem_cache_free+0xfe/0x390\n cachefiles_put_object+0x241/0x480\n fscache_cookie_state_machine+0x5c8/0x1230\n [...]\n==================================================================\n\nFollowing is the process that triggers the issue:\n\n     mount  |   daemon_thread1    |    daemon_thread2\n------------------------------------------------------------\ncachefiles_withdraw_cookie\n cachefiles_ondemand_clean_object(object)\n  cachefiles_ondemand_send_req\n   REQ_A = kzalloc(sizeof(*req) + data_len)\n   wait_for_completion(\u0026REQ_A-\u003edone)\n\n            cachefiles_daemon_read\n             cachefiles_ondemand_daemon_read\n              REQ_A = cachefiles_ondemand_select_req\n              msg-\u003eobject_id = req-\u003eobject-\u003eondemand-\u003eondemand_id\n                                  ------ restore ------\n                                  cachefiles_ondemand_restore\n                                  xas_for_each(\u0026xas, req, ULONG_MAX)\n                                   xas_set_mark(\u0026xas, CACHEFILES_REQ_NEW)\n\n                                  cachefiles_daemon_read\n                                   cachefiles_ondemand_daemon_read\n                                    REQ_A = cachefiles_ondemand_select_req\n              copy_to_user(_buffer, msg, n)\n               xa_erase(\u0026cache-\u003ereqs, id)\n               complete(\u0026REQ_A-\u003edone)\n              ------ close(fd) ------\n              cachefiles_ondemand_fd_release\n               cachefiles_put_object\n cachefiles_put_object\n  kmem_cache_free(cachefiles_object_jar, object)\n                                    REQ_A-\u003eobject-\u003eondemand-\u003eondemand_id\n                                     // object UAF !!!\n\nWhen we see the request within xa_lock, req-\u003eobject must not have been\nfreed yet, so grab the reference count of object before xa_unlock to\navoid the above issue."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:21:56.519Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cb55625f8eb9d2de8be4da0c4580d48cbb32058e"
        },
        {
          "url": "https://git.kernel.org/stable/c/3958679c49152391209b32be3357193300a51abd"
        },
        {
          "url": "https://git.kernel.org/stable/c/93064676a2820420a2d37d7c8289f277fe20793d"
        },
        {
          "url": "https://git.kernel.org/stable/c/da4a827416066191aafeeccee50a8836a826ba10"
        }
      ],
      "title": "cachefiles: fix slab-use-after-free in cachefiles_ondemand_daemon_read()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-39510",
    "datePublished": "2024-07-12T12:20:40.901Z",
    "dateReserved": "2024-06-25T14:23:23.753Z",
    "dateUpdated": "2026-05-11T20:21:56.519Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-39510",
      "date": "2026-09-17",
      "epss": "0.00284",
      "percentile": "0.20992"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-39510\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-07-12T13:15:13.283\",\"lastModified\":\"2026-06-17T07:42:04.727\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncachefiles: fix slab-use-after-free in cachefiles_ondemand_daemon_read()\\n\\nWe got the following issue in a fuzz test of randomly issuing the restore\\ncommand:\\n\\n==================================================================\\nBUG: KASAN: slab-use-after-free in cachefiles_ondemand_daemon_read+0xb41/0xb60\\nRead of size 8 at addr ffff888122e84088 by task ondemand-04-dae/963\\n\\nCPU: 13 PID: 963 Comm: ondemand-04-dae Not tainted 6.8.0-dirty #564\\nCall Trace:\\n kasan_report+0x93/0xc0\\n cachefiles_ondemand_daemon_read+0xb41/0xb60\\n vfs_read+0x169/0xb50\\n ksys_read+0xf5/0x1e0\\n\\nAllocated by task 116:\\n kmem_cache_alloc+0x140/0x3a0\\n cachefiles_lookup_cookie+0x140/0xcd0\\n fscache_cookie_state_machine+0x43c/0x1230\\n [...]\\n\\nFreed by task 792:\\n kmem_cache_free+0xfe/0x390\\n cachefiles_put_object+0x241/0x480\\n fscache_cookie_state_machine+0x5c8/0x1230\\n [...]\\n==================================================================\\n\\nFollowing is the process that triggers the issue:\\n\\n     mount  |   daemon_thread1    |    daemon_thread2\\n------------------------------------------------------------\\ncachefiles_withdraw_cookie\\n cachefiles_ondemand_clean_object(object)\\n  cachefiles_ondemand_send_req\\n   REQ_A = kzalloc(sizeof(*req) + data_len)\\n   wait_for_completion(\u0026REQ_A-\u003edone)\\n\\n            cachefiles_daemon_read\\n             cachefiles_ondemand_daemon_read\\n              REQ_A = cachefiles_ondemand_select_req\\n              msg-\u003eobject_id = req-\u003eobject-\u003eondemand-\u003eondemand_id\\n                                  ------ restore ------\\n                                  cachefiles_ondemand_restore\\n                                  xas_for_each(\u0026xas, req, ULONG_MAX)\\n                                   xas_set_mark(\u0026xas, CACHEFILES_REQ_NEW)\\n\\n                                  cachefiles_daemon_read\\n                                   cachefiles_ondemand_daemon_read\\n                                    REQ_A = cachefiles_ondemand_select_req\\n              copy_to_user(_buffer, msg, n)\\n               xa_erase(\u0026cache-\u003ereqs, id)\\n               complete(\u0026REQ_A-\u003edone)\\n              ------ close(fd) ------\\n              cachefiles_ondemand_fd_release\\n               cachefiles_put_object\\n cachefiles_put_object\\n  kmem_cache_free(cachefiles_object_jar, object)\\n                                    REQ_A-\u003eobject-\u003eondemand-\u003eondemand_id\\n                                     // object UAF !!!\\n\\nWhen we see the request within xa_lock, req-\u003eobject must not have been\\nfreed yet, so grab the reference count of object before xa_unlock to\\navoid the above issue.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: cachefiles: fix slab-use-after-free in cachefiles_ondemand_daemon_read() Obtuvimos el siguiente problema en una prueba de ejecuci\u00f3n aleatoria del comando de restauraci\u00f3n: ======== ==================================================== ======== ERROR: KASAN: slab-use-after-free en cachefiles_ondemand_daemon_read+0xb41/0xb60 Lectura de tama\u00f1o 8 en la direcci\u00f3n ffff888122e84088 por tarea ondemand-04-dae/963 CPU: 13 PID: 963 Comm: ondemand -04-dae Not tainted 6.8.0-dirty #564 Seguimiento de llamadas: kasan_report+0x93/0xc0 cachefiles_ondemand_daemon_read+0xb41/0xb60 vfs_read+0x169/0xb50 ksys_read+0xf5/0x1e0 Asignado por tarea 116: kmem_cache_alloc+0x14 0/0x3a0 cachefiles_lookup_cookie+0x140/ 0xcd0 fscache_cookie_state_machine+0x43c/0x1230 [...] Liberado por la tarea 792: kmem_cache_free+0xfe/0x390 cachefiles_put_object+0x241/0x480 fscache_cookie_state_machine+0x5c8/0x1230 [...] =============== ==================================================== == El siguiente es el proceso que desencadena el problema: montar | daemon_thread1 | daemon_thread2 ------------------------------------------------- ----------- cachefiles_withdraw_cookie cachefiles_ondemand_clean_object(object) cachefiles_ondemand_send_req REQ_A = kzalloc(sizeof(*req) + data_len) wait_for_completion(\u0026amp;REQ_A-\u0026gt;done) cachefiles_daemon_read cachefiles_ondemand_daemon_read REQ_A = cachefiles_ondemand_select_req- \u0026gt;object_id = solicitud-\u0026gt;objeto -\u0026gt;ondemand-\u0026gt;ondemand_id ------ restaurar ------ cachefiles_ondemand_restore xas_for_each(\u0026amp;xas, req, ULONG_MAX) xas_set_mark(\u0026amp;xas, CACHEFILES_REQ_NEW) cachefiles_daemon_read cachefiles_ondemand_daemon_read REQ_A = cachefiles_ondemand_select_req er, mensaje, n) xa_erase(\u0026amp;cache -\u0026gt;reqs, id) complete(\u0026amp;REQ_A-\u0026gt;done) ------ close(fd) ------ cachefiles_ondemand_fd_release cachefiles_put_object cachefiles_put_object kmem_cache_free(cachefiles_object_jar, object) REQ_A-\u0026gt;object-\u0026gt;ondemand-\u0026gt;ondemand_id // objeto UAF !!! Cuando vemos la solicitud dentro de xa_lock, req-\u0026gt;object no debe haberse liberado a\u00fan, as\u00ed que tome el recuento de referencia del objeto antes de xa_unlock para evitar el problema anterior.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/cachefiles/ondemand.c\",\"include/trace/events/cachefiles.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"f17443d52d805c9a7fab5e67a4e8b973626fe1cd\",\"lessThan\":\"cb55625f8eb9d2de8be4da0c4580d48cbb32058e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f740fd943bb1fbf79b7eaba3c71eb7536f437f51\",\"lessThan\":\"3958679c49152391209b32be3357193300a51abd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0a7e54c1959c0feb2de23397ec09c7692364313e\",\"lessThan\":\"93064676a2820420a2d37d7c8289f277fe20793d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0a7e54c1959c0feb2de23397ec09c7692364313e\",\"lessThan\":\"da4a827416066191aafeeccee50a8836a826ba10\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/cachefiles/ondemand.c\",\"include/trace/events/cachefiles.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.8\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.8\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9.6\",\"lessThanOrEqual\":\"6.9.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T17:06:40.868593Z\",\"id\":\"CVE-2024-39510\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.8\",\"versionEndExcluding\":\"6.9.6\",\"matchCriteriaId\":\"5A16B675-D12F-49F9-AB96-23E6074FF336\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"2EBB4392-5FA6-4DA9-9772-8F9C750109FA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"331C2F14-12C7-45D5-893D-8C52EE38EA10\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"3173713D-909A-4DD3-9DD4-1E171EB057EE\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3958679c49152391209b32be3357193300a51abd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/93064676a2820420a2d37d7c8289f277fe20793d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cb55625f8eb9d2de8be4da0c4580d48cbb32058e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/da4a827416066191aafeeccee50a8836a826ba10\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3958679c49152391209b32be3357193300a51abd\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/93064676a2820420a2d37d7c8289f277fe20793d\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cb55625f8eb9d2de8be4da0c4580d48cbb32058e\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/da4a827416066191aafeeccee50a8836a826ba10\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-01-13T22:56:50+00:00",
      "cve": "CVE-2024-39510",
      "id": "CVE-2024-39510",
      "initial_release_date": "2024-07-12T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: cachefiles: fix slab-use-after-free in cachefiles_ondemand_daemon_read()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-39510.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/cb55625f8eb9d2de8be4da0c4580d48cbb32058e\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/3958679c49152391209b32be3357193300a51abd\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/93064676a2820420a2d37d7c8289f277fe20793d\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/da4a827416066191aafeeccee50a8836a826ba10\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T21:56:30.908Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-39510\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T17:06:40.868593Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:24.971Z\"}}], \"cna\": {\"title\": \"cachefiles: fix slab-use-after-free in cachefiles_ondemand_daemon_read()\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"f17443d52d805c9a7fab5e67a4e8b973626fe1cd\", \"lessThan\": \"cb55625f8eb9d2de8be4da0c4580d48cbb32058e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f740fd943bb1fbf79b7eaba3c71eb7536f437f51\", \"lessThan\": \"3958679c49152391209b32be3357193300a51abd\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0a7e54c1959c0feb2de23397ec09c7692364313e\", \"lessThan\": \"93064676a2820420a2d37d7c8289f277fe20793d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0a7e54c1959c0feb2de23397ec09c7692364313e\", \"lessThan\": \"da4a827416066191aafeeccee50a8836a826ba10\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/cachefiles/ondemand.c\", \"include/trace/events/cachefiles.h\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.8\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.8\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.9.6\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/cachefiles/ondemand.c\", \"include/trace/events/cachefiles.h\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/cb55625f8eb9d2de8be4da0c4580d48cbb32058e\"}, {\"url\": \"https://git.kernel.org/stable/c/3958679c49152391209b32be3357193300a51abd\"}, {\"url\": \"https://git.kernel.org/stable/c/93064676a2820420a2d37d7c8289f277fe20793d\"}, {\"url\": \"https://git.kernel.org/stable/c/da4a827416066191aafeeccee50a8836a826ba10\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncachefiles: fix slab-use-after-free in cachefiles_ondemand_daemon_read()\\n\\nWe got the following issue in a fuzz test of randomly issuing the restore\\ncommand:\\n\\n==================================================================\\nBUG: KASAN: slab-use-after-free in cachefiles_ondemand_daemon_read+0xb41/0xb60\\nRead of size 8 at addr ffff888122e84088 by task ondemand-04-dae/963\\n\\nCPU: 13 PID: 963 Comm: ondemand-04-dae Not tainted 6.8.0-dirty #564\\nCall Trace:\\n kasan_report+0x93/0xc0\\n cachefiles_ondemand_daemon_read+0xb41/0xb60\\n vfs_read+0x169/0xb50\\n ksys_read+0xf5/0x1e0\\n\\nAllocated by task 116:\\n kmem_cache_alloc+0x140/0x3a0\\n cachefiles_lookup_cookie+0x140/0xcd0\\n fscache_cookie_state_machine+0x43c/0x1230\\n [...]\\n\\nFreed by task 792:\\n kmem_cache_free+0xfe/0x390\\n cachefiles_put_object+0x241/0x480\\n fscache_cookie_state_machine+0x5c8/0x1230\\n [...]\\n==================================================================\\n\\nFollowing is the process that triggers the issue:\\n\\n     mount  |   daemon_thread1    |    daemon_thread2\\n------------------------------------------------------------\\ncachefiles_withdraw_cookie\\n cachefiles_ondemand_clean_object(object)\\n  cachefiles_ondemand_send_req\\n   REQ_A = kzalloc(sizeof(*req) + data_len)\\n   wait_for_completion(\u0026REQ_A-\u003edone)\\n\\n            cachefiles_daemon_read\\n             cachefiles_ondemand_daemon_read\\n              REQ_A = cachefiles_ondemand_select_req\\n              msg-\u003eobject_id = req-\u003eobject-\u003eondemand-\u003eondemand_id\\n                                  ------ restore ------\\n                                  cachefiles_ondemand_restore\\n                                  xas_for_each(\u0026xas, req, ULONG_MAX)\\n                                   xas_set_mark(\u0026xas, CACHEFILES_REQ_NEW)\\n\\n                                  cachefiles_daemon_read\\n                                   cachefiles_ondemand_daemon_read\\n                                    REQ_A = cachefiles_ondemand_select_req\\n              copy_to_user(_buffer, msg, n)\\n               xa_erase(\u0026cache-\u003ereqs, id)\\n               complete(\u0026REQ_A-\u003edone)\\n              ------ close(fd) ------\\n              cachefiles_ondemand_fd_release\\n               cachefiles_put_object\\n cachefiles_put_object\\n  kmem_cache_free(cachefiles_object_jar, object)\\n                                    REQ_A-\u003eobject-\u003eondemand-\u003eondemand_id\\n                                     // object UAF !!!\\n\\nWhen we see the request within xa_lock, req-\u003eobject must not have been\\nfreed yet, so grab the reference count of object before xa_unlock to\\navoid the above issue.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9.6\", \"versionStartIncluding\": \"6.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10\", \"versionStartIncluding\": \"6.8\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T09:17:21.351Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-39510\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-11-03T21:56:30.908Z\", \"dateReserved\": \"2024-06-25T14:23:23.753Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-07-12T12:20:40.901Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.