CVE-2024-41012: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-41012 is a security vulnerability in the Linux kernel's file locking mechanism, discovered and disclosed on July 23, 2024. The vulnerability affects Linux kernel versions from 2.6.13 up to (excluding) 6.9.9, including various release candidates of version 6.10. The issue occurs in the filelock subsystem when fcntl_setlk() races with close() operations (NVD).

The vulnerability arises when fcntl_setlk() races with close() operations, where it attempts to remove the created lock using do_lock_file_wait(). Linux Security Modules (LSMs) can allow the first do_lock_file_wait() that created the lock while denying the second do_lock_file_wait() that attempts to remove the lock. Additionally, posix_lock_file() could fail to remove a lock due to GFP_KERNEL allocation failure when splitting a range in the middle. The vulnerability has been assigned a CVSS v3.1 base score of 6.3 (MEDIUM) with vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H (NVD).

After the bug is triggered, use-after-free reads occur in lock_get_status() when userspace reads /proc/locks. This vulnerability can potentially be exploited to read arbitrary kernel memory, although it cannot be used to corrupt kernel memory. The issue specifically affects systems with SELinux, Smack, AppArmor, or BPF-LSM in enforcing mode and only works from certain security contexts (Kernel Patch).

The vulnerability requires local access and high complexity to exploit. It needs low privileges and no user interaction. The exploit potential is limited to systems running affected Linux kernel versions with specific security modules in enforcing mode. The vulnerability has been classified as CWE-416 (Use After Free) (NVD).

The vulnerability has been fixed by modifying the code to call locks_remove_posix() instead of using do_lock_file_wait() for lock removal. This function is specifically designed to reliably remove POSIX locks associated with the given file and files_struct, similar to the mechanism used by filp_flush(). Users should update their Linux kernel to the latest patched version (Kernel Patch).