Riskcovery

CVE-2024-41075

cachefiles: add consistency check for copen/cread

State
Published
Severity
7.8 High
Published
Jul 29, 2024
Updated
Aug 5, 2026
Reserved
Jul 12, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

cachefiles: add consistency check for copen/cread

This prevents malicious processes from completing random copen/cread requests and crashing the system. Added checks are listed below:

* Generic, copen can only complete open requests, and cread can only complete read requests. * For copen, ondemand_id must not be 0, because this indicates that the request has not been read by the daemon. * For cread, the object corresponding to fd and req should be the same.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 9032b6e8589f269743984aac53e82e4835be16dc to before 3b744884c0431b5a62c92900e64bfd0ed61e8e2aAffected
  • 9032b6e8589f269743984aac53e82e4835be16dc to before 36d845ccd7bf527110a65fe953886a176c209539Affected
  • 9032b6e8589f269743984aac53e82e4835be16dc to before 8aaa6c5dd2940ab934d6cd296175f43dbb32b34aAffected
  • 9032b6e8589f269743984aac53e82e4835be16dc to before a26dc49df37e996876f50a0210039b2d211fdd6fAffected
LinuxLinux
  • 5.19Affected
  • before 5.19Not affected
  • 6.1.101 through 6.1.*Not affected
  • 6.6.42 through 6.6.*Not affected
  • 6.9.11 through 6.9.*Not affected
  • 6.10 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.