Description
In the Linux kernel, the following vulnerability has been resolved: cachefiles: flush all requests after setting CACHEFILES_DEAD In ondemand mode, when the daemon is processing an open request, if the kernel flags the cache as CACHEFILES_DEAD, the cachefiles_daemon_write() will always return -EIO, so the daemon can't pass the copen to the kernel. Then the kernel process that is waiting for the copen triggers a hung_task. Since the DEAD state is irreversible, it can only be exited by closing /dev/cachefiles. Therefore, after calling cachefiles_io_error() to mark the cache as CACHEFILES_DEAD, if in ondemand mode, flush all requests to avoid the above hungtask. We may still be able to read some of the cached data before closing the fd of /dev/cachefiles. Note that this relies on the patch that adds reference counting to the req, otherwise it may UAF.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
c8383054506c77b814489c09877b5db83fd4abf2 to < 320ba9cbca78be79c912143bbba1d1b35ca55cf0affectedc8383054506c77b814489c09877b5db83fd4abf2 to < 3bf0b8030296e9ee60d3d4c15849ad9ac0b47081affectedc8383054506c77b814489c09877b5db83fd4abf2 to < e73fac95084839c5178d97e81c6a2051251bdc00affectedc8383054506c77b814489c09877b5db83fd4abf2 to < 85e833cd7243bda7285492b0653c3abb1e2e757baffected
Linux Linux
Default version status: affected
5.19affected0 to < 5.19unaffected6.1.95 to ≤ 6.1.*unaffected6.6.35 to ≤ 6.6.*unaffected6.9.6 to ≤ 6.9.*unaffected6.10 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/320ba9cbca78be79c912143bbba1d1b35ca55cf0 ↗
- https://git.kernel.org/stable/c/3bf0b8030296e9ee60d3d4c15849ad9ac0b47081 ↗
- https://git.kernel.org/stable/c/e73fac95084839c5178d97e81c6a2051251bdc00 ↗
- https://git.kernel.org/stable/c/85e833cd7243bda7285492b0653c3abb1e2e757b ↗
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html ↗