CVE-2024-41057: 
Linux Kernel vulnerability analysis and mitigation

A slab-use-after-free vulnerability was discovered in the Linux kernel's cachefiles subsystem, specifically in the cachefiles_withdraw_cookie() function. The vulnerability was assigned CVE-2024-41057 and affects Linux kernel versions from 5.17 up to (excluding) 6.1.101, 6.2 up to (excluding) 6.6.42, and 6.7 up to (excluding) 6.9.11. The issue was discovered during fault injection stress testing (NVD).

The vulnerability occurs due to improper handling of volume withdrawal in the cachefiles subsystem. When FSCACHE_CACHE_IS_WITHDRAWN is set, a race condition can occur where cookie lookups complete after volume has been freed, leading to a use-after-free condition. The issue was detected by KASAN (Kernel Address Sanitizer) showing a slab-use-after-free in cachefiles_withdraw_cookie() when reading 8 bytes at a specific memory address (Kernel Patch). The vulnerability has been assigned a CVSS v3.1 base score of 7.8 HIGH with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

The vulnerability could allow a local attacker with low privileges to potentially achieve high impacts on confidentiality, integrity, and availability of the system. This is reflected in the CVSS scoring which indicates high potential impact across all three security metrics (NVD).

The vulnerability requires local access with low privileges and no user interaction to exploit. The attack complexity is rated as low, indicating that the vulnerability is relatively straightforward to exploit under the right conditions (NVD).

The vulnerability has been fixed in the Linux kernel through a patch that modifies the volume withdrawal process. The fix ensures that fscache_withdraw_volume() is called before cachefiles_withdraw_objects(), preventing the race condition. Users should upgrade to Linux kernel versions 6.1.101, 6.6.42, 6.9.11 or later depending on their kernel branch (Kernel Patch).