{"id":"CVE-2024-56549","state":"PUBLISHED","title":"cachefiles: Fix NULL pointer dereference in object->file","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ncachefiles: Fix NULL pointer dereference in object->file\n\nAt present, the object->file has the NULL pointer dereference problem in\nondemand-mode. The root cause is that the allocated fd and object->file\nlifetime are inconsistent, and the user-space invocation to anon_fd uses\nobject->file. Following is the process that triggers the issue:\n\n\t  [write fd]\t\t\t\t[umount]\ncachefiles_ondemand_fd_write_iter\n\t\t\t\t       fscache_cookie_state_machine\n\t\t\t\t\t cachefiles_withdraw_cookie\n  if (!file) return -ENOBUFS\n\t\t\t\t\t   cachefiles_clean_up_object\n\t\t\t\t\t     cachefiles_unmark_inode_in_use\n\t\t\t\t\t     fput(object->file)\n\t\t\t\t\t     object->file = NULL\n  // file NULL pointer dereference!\n  __cachefiles_write(..., file, ...)\n\nFix this issue by add an additional reference count to the object->file\nbefore write/llseek, and decrement after it finished.","publishedAt":"2024-12-27T14:11:30.336Z","updatedAt":"2026-10-15T21:41:47.066Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"c8383054506c77b814489c09877b5db83fd4abf2","status":"affected","lessThan":"d6bba3ece960129a553d4b16f1b00c884dc0993a","versionType":"git"},{"version":"c8383054506c77b814489c09877b5db83fd4abf2","status":"affected","lessThan":"785408bbafcfa24c9fc5b251f03fd0780ce182bd","versionType":"git"},{"version":"c8383054506c77b814489c09877b5db83fd4abf2","status":"affected","lessThan":"f98770440c9bc468e2fd878212ec9526dbe08293","versionType":"git"},{"version":"c8383054506c77b814489c09877b5db83fd4abf2","status":"affected","lessThan":"9582c7664103c9043e80a78f5c382aa6bdd67418","versionType":"git"},{"version":"c8383054506c77b814489c09877b5db83fd4abf2","status":"affected","lessThan":"31ad74b20227ce6b40910ff78b1c604e42975cf1","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/cachefiles/interface.c","fs/cachefiles/ondemand.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.19","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.19","versionType":"semver"},{"version":"6.1.129","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.78","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.11.11","status":"unaffected","lessThanOrEqual":"6.11.*","versionType":"semver"},{"version":"6.12.2","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.13","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/cachefiles/interface.c","fs/cachefiles/ondemand.c"]}],"references":["https://git.kernel.org/stable/c/d6bba3ece960129a553d4b16f1b00c884dc0993a","https://git.kernel.org/stable/c/785408bbafcfa24c9fc5b251f03fd0780ce182bd","https://git.kernel.org/stable/c/f98770440c9bc468e2fd878212ec9526dbe08293","https://git.kernel.org/stable/c/9582c7664103c9043e80a78f5c382aa6bdd67418","https://git.kernel.org/stable/c/31ad74b20227ce6b40910ff78b1c604e42975cf1","https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html"],"weaknesses":[],"ingestedAt":"2026-10-29T20:08:12.933Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/56xxx/CVE-2024-56549.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-56549","state":"PUBLISHED","datePublished":"2024-12-27T14:11:30.336Z","dateUpdated":"2026-10-15T21:41:47.066Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2024-12-27T14:03:05.989Z"},"containers":{"cna":{"title":"cachefiles: Fix NULL pointer dereference in object->file","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncachefiles: Fix NULL pointer dereference in object->file\n\nAt present, the object->file has the NULL pointer dereference problem in\nondemand-mode. The root cause is that the allocated fd and object->file\nlifetime are inconsistent, and the user-space invocation to anon_fd uses\nobject->file. Following is the process that triggers the issue:\n\n\t  [write fd]\t\t\t\t[umount]\ncachefiles_ondemand_fd_write_iter\n\t\t\t\t       fscache_cookie_state_machine\n\t\t\t\t\t cachefiles_withdraw_cookie\n  if (!file) return -ENOBUFS\n\t\t\t\t\t   cachefiles_clean_up_object\n\t\t\t\t\t     cachefiles_unmark_inode_in_use\n\t\t\t\t\t     fput(object->file)\n\t\t\t\t\t     object->file = NULL\n  // file NULL pointer dereference!\n  __cachefiles_write(..., file, ...)\n\nFix this issue by add an additional reference count to the object->file\nbefore write/llseek, and decrement after it finished."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"c8383054506c77b814489c09877b5db83fd4abf2","status":"affected","lessThan":"d6bba3ece960129a553d4b16f1b00c884dc0993a","versionType":"git"},{"version":"c8383054506c77b814489c09877b5db83fd4abf2","status":"affected","lessThan":"785408bbafcfa24c9fc5b251f03fd0780ce182bd","versionType":"git"},{"version":"c8383054506c77b814489c09877b5db83fd4abf2","status":"affected","lessThan":"f98770440c9bc468e2fd878212ec9526dbe08293","versionType":"git"},{"version":"c8383054506c77b814489c09877b5db83fd4abf2","status":"affected","lessThan":"9582c7664103c9043e80a78f5c382aa6bdd67418","versionType":"git"},{"version":"c8383054506c77b814489c09877b5db83fd4abf2","status":"affected","lessThan":"31ad74b20227ce6b40910ff78b1c604e42975cf1","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/cachefiles/interface.c","fs/cachefiles/ondemand.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.19","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.19","versionType":"semver"},{"version":"6.1.129","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.78","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.11.11","status":"unaffected","lessThanOrEqual":"6.11.*","versionType":"semver"},{"version":"6.12.2","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.13","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/cachefiles/interface.c","fs/cachefiles/ondemand.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/d6bba3ece960129a553d4b16f1b00c884dc0993a"},{"url":"https://git.kernel.org/stable/c/785408bbafcfa24c9fc5b251f03fd0780ce182bd"},{"url":"https://git.kernel.org/stable/c/f98770440c9bc468e2fd878212ec9526dbe08293"},{"url":"https://git.kernel.org/stable/c/9582c7664103c9043e80a78f5c382aa6bdd67418"},{"url":"https://git.kernel.org/stable/c/31ad74b20227ce6b40910ff78b1c604e42975cf1"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable code is reached through local file-descriptor operations (write()/lseek() on a cachefiles on-demand anon fd) raced against local cookie withdrawal (umount, LRU discard, invalidation). There is no remote or adjacent-network path into fs/cachefiles/ondemand.c.\nAC:L - The attacker controls both sides of the race — they generate the demand-read traffic that makes the daemon write on the anon fd, and they trigger the withdrawal (umount of their erofs-on-fscache mount, or letting the cookie idle past the ~2s LRU timeout) — and can retry the sequence indefinitely until the window is hit.\nPR:L - Although /dev/cachefiles itself requires CAP_SYS_ADMIN, an unprivileged local user of an on-demand erofs/fscache mount (e.g. inside a container using an on-demand image) drives both the daemon's writes and the cookie withdrawal without ever needing the anon fd, so basic unprivileged local access suffices.\nUI:N - No victim action is needed; the cachefiles daemon services demand-read requests automatically as part of normal operation, and the withdrawal path is driven by the attacker's own filesystem activity.\nS:U - The corruption is confined to kernel memory within the same security authority; this is standard kernel memory corruption, not a hypervisor, IOMMU, or sandbox boundary crossing.\nC:H - The use-after-free on struct file lets llseek/SEEK_DATA/SEEK_HOLE and DIO operations act on a freed slot that filp_cachep (SLAB_TYPESAFE_BY_RCU) hands out as an unrelated struct file, exposing freed-memory contents and redirecting reads to files the attacker has no access to.\nI:H - __cachefiles_write() calls get_file() and vfs_iocb_iter_write() on the dangling pointer, inflating a reallocated file's refcount (setting up a further UAF) and writing attacker-influenced cache data — plus fallocate() — into an unrelated open file, giving a controlled write primitive.\nA:H - Dereferencing the freed/NULLed object->file causes a kernel oops or panic, and the refcount corruption on the reallocated struct file leads to further fatal memory corruption."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T11:44:58.475Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.19","versionEndExcluding":"6.1.129"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.19","versionEndExcluding":"6.6.78"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.19","versionEndExcluding":"6.11.11"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.19","versionEndExcluding":"6.12.2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.19","versionEndExcluding":"6.13"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2025-11-03T19:32:24.323Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-56549","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-15T21:41:03.958345Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-15T21:41:47.066Z"}}]}}}