Bug 2300451 (CVE-2024-41074)

Summary: CVE-2024-41074 kernel: cachefiles: Set object to close if ondemand_id < 0 in copen
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: dfreiber, drow, jburrell, vkumar
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: kernel 6.1.101, kernel 6.6.42, kernel 6.9.11, kernel 6.10 Doc Type: If docs needed, set a value
Doc Text:
A vulnerability was found in the `cachefiles` subsystem in the Linux Kernel involving the `copen` function being misused with an `ondemand_id` less than 0. This could lead to the deletion of a request before it was read, causing the request to be skipped and blocking other processes. The issue was fixed by ensuring that if the `ondemand_id` is less than 0, the object is set to close. This prevents requests from being skipped and ensures proper handling and completion of read requests, maintaining system stability.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2301639    
Bug Blocks:    

Description OSIDB Bzimport 2024-07-29 15:50:16 UTC 
In the Linux kernel, the following vulnerability has been resolved:

cachefiles: Set object to close if ondemand_id < 0 in copen

If copen is maliciously called in the user mode, it may delete the request
corresponding to the random id. And the request may have not been read yet.

Note that when the object is set to reopen, the open request will be done
with the still reopen state in above case. As a result, the request
corresponding to this object is always skipped in select_req function, so
the read request is never completed and blocks other process.

Fix this issue by simply set object to close if its id < 0 in copen.
Comment 1 Mauro Matteo Cascella 2024-07-30 13:49:08 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024072910-CVE-2024-41074-e5d9@gregkh/T
Comment 2 Mauro Matteo Cascella 2024-07-30 13:49:28 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2301639]