Review reviewHigh

CVE-2024-41057

Linux Linux, linux kernel

In the Linux kernel, the following vulnerability has been resolved: cachefiles: fix slab-use-after-free in cachefiles_withdraw_cookie() We got the following issue in our fault injection stress test: ================================================================== BUG: KASAN: slab-use-after-free in cachefiles_withdraw_cookie+0x4d9/0x600 Read of size 8 at addr ffff888118efc000 by task kworker/u78:0/109 CPU: 13 PID: 109 Comm: kworker/u78:0 Not tainted 6.8.0-dirty #566 Call Trace: <TASK> kasan_report+0x93/0xc0 cachefiles_withdraw_cookie+0x4d9/0x600 fscache_cookie_state_machine+0x5c8/0x1230 fs...

CVSS: 7
EPSS: 0.28%
CISA KEV: Not listed
Published: 2024.07.30

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability0.28%

Technical severityCVSS 7

Vulnerability overview

Affected product and versions

Product: Linux Linux, linux kernel
Affected versions: >= fe2140e2f57fef8562e0f9b7cd447d2b08dc2f35 < 8de253177112a47c9af157d23ae934779188b4e1, >= fe2140e2f57fef8562e0f9b7cd447d2b08dc2f35 < 9e67589a4a7b7e5660b524d1d5fe61242bcbcc11, >= fe2140e2f57fef8562e0f9b7cd447d2b08dc2f35 < ef81340401e8a371d6b17f69e76d861920972cfe, >= fe2140e2f57fef8562e0f9b7cd447d2b08dc2f35 < 5d8f805789072ea7fd39504694b7bd17e5f751c4, >= 5.17, >= 5.17 < 6.1.101, >= 6.2 < 6.6.42, >= 6.7 < 6.9.11
Fixed versions: 6.1.101, 6.6.42, 6.9.11

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that Linux Linux, linux kernel and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-416