In the Linux kernel, the following vulnerability has been resolved:
cachefiles: fix memory leak in cachefilesaddcache()
The following memory leak was reported after unbinding /dev/cachefiles:
================================================================== unreferenced object 0xffff9b674176e3c0 (size 192): comm "cachefilesd2", pid 680, jiffies 4294881224 hex dump (first 32 bytes): 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc ea38a44b): [<ffffffff8eb8a1a5>] kmemcachealloc+0x2d5/0x370 [<ffffffff8e917f86>] preparecreds+0x26/0x2e0 [<ffffffffc002eeef>] cachefilesdeterminecachesecurity+0x1f/0x120 [<ffffffffc00243ec>] cachefilesaddcache+0x13c/0x3a0 [<ffffffffc0025216>] cachefilesdaemonwrite+0x146/0x1c0 [<ffffffff8ebc4a3b>] vfswrite+0xcb/0x520 [<ffffffff8ebc5069>] ksyswrite+0x69/0xf0 [<ffffffff8f6d4662>] dosyscall64+0x72/0x140
Put the reference count of cachecred in cachefilesdaemonunbind() to fix the problem. And also put cachecred in cachefilesaddcache() error branch to avoid memory leaks.
[
{
"deprecated": false,
"target": {
"file": "fs/cachefiles/bind.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"54538356880755707275899757253209167647",
"6481340339155955614485395559728265124",
"288647802660492138165426895138907517306",
"329298338217306426472836222482096929206",
"45910034298377001457235430033787825297",
"134796906091772829845212826615504613033",
"143280475534257518213449712085577965179",
"15174211586214410909207839889790341882"
]
},
"id": "CVE-2024-26840-1afe7fb5",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@94965be37add0983672e48ecb33cdbda92b62579",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "fs/cachefiles/daemon.c",
"function": "cachefiles_daemon_unbind"
},
"digest": {
"function_hash": "127488657396643552954737991513274246266",
"length": 343.0
},
"id": "CVE-2024-26840-31bbec5a",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8b218e2f0a27a9f09428b1847b4580640b9d1e58",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "fs/cachefiles/bind.c",
"function": "cachefiles_daemon_unbind"
},
"digest": {
"function_hash": "327301976123947903563783187088824528048",
"length": 401.0
},
"id": "CVE-2024-26840-41c119bf",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@94965be37add0983672e48ecb33cdbda92b62579",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "fs/cachefiles/cache.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"236113517085619273213173873767586974382",
"171524272546845429377772076454932259554",
"182072289468585943425717468827752342021",
"38288902312260294243034747814957170913"
]
},
"id": "CVE-2024-26840-4b7973e9",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8b218e2f0a27a9f09428b1847b4580640b9d1e58",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "fs/cachefiles/bind.c",
"function": "cachefiles_daemon_add_cache"
},
"digest": {
"function_hash": "287641186820876894871064641021680609406",
"length": 3667.0
},
"id": "CVE-2024-26840-55937eb7",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@43eccc5823732ba6daab2511ed32dfc545a666d8",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "fs/cachefiles/bind.c",
"function": "cachefiles_daemon_add_cache"
},
"digest": {
"function_hash": "164124352186263478934166015253839554660",
"length": 3770.0
},
"id": "CVE-2024-26840-823497dc",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@94965be37add0983672e48ecb33cdbda92b62579",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "fs/cachefiles/cache.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"236113517085619273213173873767586974382",
"171524272546845429377772076454932259554",
"182072289468585943425717468827752342021",
"38288902312260294243034747814957170913"
]
},
"id": "CVE-2024-26840-826aa103",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@38e921616320d159336b0ffadb09e9fb4945c7c3",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "fs/cachefiles/cache.c",
"function": "cachefiles_add_cache"
},
"digest": {
"function_hash": "53079277058268156342511966526185509398",
"length": 3413.0
},
"id": "CVE-2024-26840-85cf419e",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8b218e2f0a27a9f09428b1847b4580640b9d1e58",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "fs/cachefiles/daemon.c",
"function": "cachefiles_daemon_unbind"
},
"digest": {
"function_hash": "127488657396643552954737991513274246266",
"length": 343.0
},
"id": "CVE-2024-26840-a58f3638",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@38e921616320d159336b0ffadb09e9fb4945c7c3",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "fs/cachefiles/daemon.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"202773197921321416060623840624280162570",
"311033813349380555853298349337166066139",
"297685824067764646997112095278101485519",
"15174211586214410909207839889790341882"
]
},
"id": "CVE-2024-26840-b21e5a24",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@38e921616320d159336b0ffadb09e9fb4945c7c3",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "fs/cachefiles/bind.c",
"function": "cachefiles_daemon_unbind"
},
"digest": {
"function_hash": "327301976123947903563783187088824528048",
"length": 401.0
},
"id": "CVE-2024-26840-b96734a3",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@43eccc5823732ba6daab2511ed32dfc545a666d8",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "fs/cachefiles/daemon.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"202773197921321416060623840624280162570",
"311033813349380555853298349337166066139",
"297685824067764646997112095278101485519",
"15174211586214410909207839889790341882"
]
},
"id": "CVE-2024-26840-c5d1efbe",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8b218e2f0a27a9f09428b1847b4580640b9d1e58",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "fs/cachefiles/bind.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"54538356880755707275899757253209167647",
"6481340339155955614485395559728265124",
"288647802660492138165426895138907517306",
"329298338217306426472836222482096929206",
"45910034298377001457235430033787825297",
"134796906091772829845212826615504613033",
"143280475534257518213449712085577965179",
"15174211586214410909207839889790341882"
]
},
"id": "CVE-2024-26840-f1452971",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@43eccc5823732ba6daab2511ed32dfc545a666d8",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "fs/cachefiles/cache.c",
"function": "cachefiles_add_cache"
},
"digest": {
"function_hash": "53079277058268156342511966526185509398",
"length": 3413.0
},
"id": "CVE-2024-26840-fd67ee68",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@38e921616320d159336b0ffadb09e9fb4945c7c3",
"signature_version": "v1"
}
]