A security flaw was found in the Linux kernel in a way that the cleancache subsystem clears an inode after the final file truncation (removal). The new file created with the same inode may contain leftover pages from cleancache and so the old file data instead of the new one. References: https://seclists.org/oss-sec/2018/q4/169 A suggested patch: https://lore.kernel.org/patchwork/patch/1011367/
Acknowledgments: Name: Vasily Averin (Virtuozzo Kernel Team), Pavel Tikhomirov (Virtuozzo Kernel Team)
Note: While RHEL-ALT and RHEL-8 are vulnerable to this flaw, only Xen's [tmem] driver is a possible backend for the CleanCache subsystem. So, a vulnerable configuration is RHEL as a Xen's guest. According to https://access.redhat.com/certified-hypervisors this is not a supported configuration, and so the flaw is not currently planned to be addressed in future updates.
External Reference: https://seclists.org/oss-sec/2018/q4/169
Created kernel tracking bugs for this issue: Affects: fedora-all [bug 1653122]