Vulnerability-Lookup

GHSA-5P8G-H9F2-V3VJ

Vulnerability from github – Published: 2024-07-29 15:30 – Updated: 2025-11-04 00:31

Details

In the Linux kernel, the following vulnerability has been resolved:

cachefiles: add consistency check for copen/cread

This prevents malicious processes from completing random copen/cread requests and crashing the system. Added checks are listed below:

Generic, copen can only complete open requests, and cread can only complete read requests.
For copen, ondemand_id must not be 0, because this indicates that the request has not been read by the daemon.
For cread, the object corresponding to fd and req should be the same.

Severity

5.5 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-41075"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-07-29T15:15:15Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ncachefiles: add consistency check for copen/cread\n\nThis prevents malicious processes from completing random copen/cread\nrequests and crashing the system. Added checks are listed below:\n\n  * Generic, copen can only complete open requests, and cread can only\n    complete read requests.\n  * For copen, ondemand_id must not be 0, because this indicates that the\n    request has not been read by the daemon.\n  * For cread, the object corresponding to fd and req should be the same.",
  "id": "GHSA-5p8g-h9f2-v3vj",
  "modified": "2025-11-04T00:31:02Z",
  "published": "2024-07-29T15:30:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41075"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/36d845ccd7bf527110a65fe953886a176c209539"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/3b744884c0431b5a62c92900e64bfd0ed61e8e2a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/8aaa6c5dd2940ab934d6cd296175f43dbb32b34a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a26dc49df37e996876f50a0210039b2d211fdd6f"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2024-41075 (GCVE-0-2024-41075)

Vulnerability from cvelistv5 – Published: 2024-07-29 14:57 – Updated: 2026-08-05 11:35

Title

cachefiles: add consistency check for copen/cread

Summary

In the Linux kernel, the following vulnerability has been resolved: cachefiles: add consistency check for copen/cread This prevents malicious processes from completing random copen/cread requests and crashing the system. Added checks are listed below: * Generic, copen can only complete open requests, and cread can only complete read requests. * For copen, ondemand_id must not be 0, because this indicates that the request has not been read by the daemon. * For cread, the object corresponding to fd and req should be the same.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-10 16:21 UTC

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 7033 records in the last 180 days details

References

5 references

URL	Tags
https://git.kernel.org/stable/c/3b744884c0431b5a6…
https://git.kernel.org/stable/c/36d845ccd7bf52711…
https://git.kernel.org/stable/c/8aaa6c5dd2940ab93…
https://git.kernel.org/stable/c/a26dc49df37e99687…
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 9032b6e8589f269743984aac53e82e4835be16dc , < 3b744884c0431b5a62c92900e64bfd0ed61e8e2a (git) Affected: 9032b6e8589f269743984aac53e82e4835be16dc , < 36d845ccd7bf527110a65fe953886a176c209539 (git) Affected: 9032b6e8589f269743984aac53e82e4835be16dc , < 8aaa6c5dd2940ab934d6cd296175f43dbb32b34a (git) Affected: 9032b6e8589f269743984aac53e82e4835be16dc , < a26dc49df37e996876f50a0210039b2d211fdd6f (git)
Linux	Linux	Affected: 5.19 Unaffected: 0 , < 5.19 (semver) Unaffected: 6.1.101 , ≤ 6.1.* (semver) Unaffected: 6.6.42 , ≤ 6.6.* (semver) Unaffected: 6.9.11 , ≤ 6.9.* (semver) Unaffected: 6.10 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:00:30.195Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3b744884c0431b5a62c92900e64bfd0ed61e8e2a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/36d845ccd7bf527110a65fe953886a176c209539"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8aaa6c5dd2940ab934d6cd296175f43dbb32b34a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a26dc49df37e996876f50a0210039b2d211fdd6f"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-41075",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:21:24.232426Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:00.106Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/cachefiles/ondemand.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3b744884c0431b5a62c92900e64bfd0ed61e8e2a",
              "status": "affected",
              "version": "9032b6e8589f269743984aac53e82e4835be16dc",
              "versionType": "git"
            },
            {
              "lessThan": "36d845ccd7bf527110a65fe953886a176c209539",
              "status": "affected",
              "version": "9032b6e8589f269743984aac53e82e4835be16dc",
              "versionType": "git"
            },
            {
              "lessThan": "8aaa6c5dd2940ab934d6cd296175f43dbb32b34a",
              "status": "affected",
              "version": "9032b6e8589f269743984aac53e82e4835be16dc",
              "versionType": "git"
            },
            {
              "lessThan": "a26dc49df37e996876f50a0210039b2d211fdd6f",
              "status": "affected",
              "version": "9032b6e8589f269743984aac53e82e4835be16dc",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/cachefiles/ondemand.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.19"
            },
            {
              "lessThan": "5.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.101",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.42",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.11",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncachefiles: add consistency check for copen/cread\n\nThis prevents malicious processes from completing random copen/cread\nrequests and crashing the system. Added checks are listed below:\n\n  * Generic, copen can only complete open requests, and cread can only\n    complete read requests.\n  * For copen, ondemand_id must not be 0, because this indicates that the\n    request has not been read by the daemon.\n  * For cread, the object corresponding to fd and req should be the same."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local access to issue `ioctl(CACHEFILES_IOC_READ_COMPLETE)` on the anonymous `[cachefiles]` file descriptor or `write()` the `copen` command to `/dev/cachefiles`. There is no network-facing path into `fs/cachefiles/ondemand.c`.\nAC:L - Request IDs are the lowest free xarray indices starting at 0, so they are trivially enumerable, and the attacker can generate requests on demand by reading files from the erofs-over-fscache mount, controlling both sides of any timing window. No condition outside the attacker\u0027s control is needed.\nPR:L - `cachefiles_ondemand_fd_ioctl()` performs no capability check at all \u2014 mere possession of the anon fd suffices \u2014 and that fd is created with `get_unused_fd_flags(O_WRONLY)` without `O_CLOEXEC`, so it is inherited across `exec()` and is routinely passed to unprivileged helper processes in on-demand cache/container-image deployments.\nUI:N - No victim action is required; the cachefiles daemon and the fscache/erofs mount are already-running system state, and the attacker itself generates the OPEN/READ requests it then maliciously completes.\nS:U - The corrupted request and object state, the truncation of backing cache files, and the resulting crashes all remain within the kernel\u0027s own security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - Completing a READ request out of band makes the netfs/erofs path treat an unpopulated range as successfully fetched, exposing raw backing cache-file contents (stale data from culled/reused cache objects) to the reader. The corrupted request/object lifetimes in this exact code region are the same class that produced KASAN slab-use-after-free reads in the sibling fixes.\nI:H - `copen` on an arbitrary request lets the attacker set any object\u0027s `cookie-\u003eobject_size`, which drives `vfs_truncate()` of the backing cache file and the on-disk coherency xattr, and lets erofs-over-fscache mounts serve wrong or unfetched content \u2014 corrupting data and executables read from container images.\nA:H - The commit exists specifically to stop malicious processes \"crashing the system\"; completing requests out of band leaves objects marked open with `ondemand_id == 0` and no anon fd, so readers block permanently in uninterruptible `wait_for_completion()` (hung task / unkillable D-state), and leaked anon fds pin cookies so later mounts hang as well."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:35:13.241Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3b744884c0431b5a62c92900e64bfd0ed61e8e2a"
        },
        {
          "url": "https://git.kernel.org/stable/c/36d845ccd7bf527110a65fe953886a176c209539"
        },
        {
          "url": "https://git.kernel.org/stable/c/8aaa6c5dd2940ab934d6cd296175f43dbb32b34a"
        },
        {
          "url": "https://git.kernel.org/stable/c/a26dc49df37e996876f50a0210039b2d211fdd6f"
        }
      ],
      "title": "cachefiles: add consistency check for copen/cread",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-41075",
    "datePublished": "2024-07-29T14:57:34.891Z",
    "dateReserved": "2024-07-12T12:17:45.632Z",
    "dateUpdated": "2026-08-05T11:35:13.241Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted