CVE-2024-53216: nfsd: release svc_expkey/svc_export with rcu_work
In the Linux kernel, the following vulnerability has been resolved:
nfsd: release svcexpkey/svcexport with rcuwork
The last reference for cachehead can be reduced to zero in cshow and eshow(using rcureadlock and rcureadunlock). Consequently, svcexportput and expkeyput will be invoked, leading to two issues:
1. The svcexportput will directly free exuuid. However, eshow/cshow will access exuuid after cacheput, which can trigger a use-after-free issue, shown below.
================================================================== BUG: KASAN: slab-use-after-free in svcexportshow+0x362/0x430 [nfsd] Read of size 1 at addr ff11000010fdc120 by task cat/870
CPU: 1 UID: 0 PID: 870 Comm: cat Not tainted 6.12.0-rc3+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 Call Trace: <TASK> dumpstacklvl+0x53/0x70 printaddressdescription.constprop.0+0x2c/0x3a0 printreport+0xb9/0x280 kasanreport+0xae/0xe0 svcexportshow+0x362/0x430 [nfsd] cshow+0x161/0x390 [sunrpc] seqreaditer+0x589/0x770 seqread+0x1e5/0x270 procregread+0xe1/0x140 vfsread+0x125/0x530 ksysread+0xc1/0x160 dosyscall64+0x5f/0x170 entrySYSCALL64afterhwframe+0x76/0x7e
Allocated by task 830: kasansavestack+0x20/0x40 kasansavetrack+0x14/0x30 kasankmalloc+0x8f/0xa0 kmallocnodetrackcallernoprof+0x1bc/0x400 kmemdupnoprof+0x22/0x50 svcexportparse+0x8a9/0xb80 [nfsd] cachedodowncall+0x71/0xa0 [sunrpc] cachewriteprocfs+0x8e/0xd0 [sunrpc] procregwrite+0xe1/0x140 vfswrite+0x1a5/0x6d0 ksyswrite+0xc1/0x160 dosyscall64+0x5f/0x170 entrySYSCALL64afterhwframe+0x76/0x7e
Freed by task 868: kasansavestack+0x20/0x40 kasansavetrack+0x14/0x30 kasansavefreeinfo+0x3b/0x60 kasanslabfree+0x37/0x50 kfree+0xf3/0x3e0 svcexportput+0x87/0xb0 [nfsd] cachepurge+0x17f/0x1f0 [sunrpc] nfsddestroyserv+0x226/0x2d0 [nfsd] nfsdsvc+0x125/0x1e0 [nfsd] writethreads+0x16a/0x2a0 [nfsd] nfsctltransactionwrite+0x74/0xa0 [nfsd] vfswrite+0x1a5/0x6d0 ksyswrite+0xc1/0x160 dosyscall64+0x5f/0x170 entrySYSCALL64afterhwframe+0x76/0x7e
2. We cannot sleep while using rcureadlock/rcureadunlock. However, svcexportput/expkeyput will call pathput, which subsequently triggers a sleeping operation due to the following dput.
============================= WARNING: suspicious RCU usage 5.10.0-dirty #141 Not tainted ----------------------------- ... Call Trace: dumpstack+0x9a/0xd0 mightsleep+0x231/0x240 dput+0x39/0x600 pathput+0x1b/0x30 svcexportput+0x17/0x80 eshow+0x1c9/0x200 seqreaditer+0x63f/0x7c0 seqread+0x226/0x2d0 vfsread+0x113/0x2c0 ksysread+0xc9/0x170 dosyscall64+0x33/0x40 entrySYSCALL64afterhwframe+0x67/0xd1
Fix these issues by using rcuwork to help release svcexpkey/svcexport. This approach allows for an asynchronous context to invoke pathput and also facilitates the freeing of uuid/exp/key after an RCU grace period.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
nfsd: release svcexpkey/svcexport with rcuwork
The last reference for cachehead can be reduced to zero in cshow and eshow(using rcureadlock and rcureadunlock). Consequently, svcexportput and expkeyput will be invoked, leading to two issues:
1. The svcexportput will directly free exuuid. However, eshow/cshow will access exuuid after cacheput, which can trigger a use-after-free issue, shown below.
================================================================== BUG: KASAN: slab-use-after-free in svcexportshow+0x362/0x430 [nfsd] Read of size 1 at addr ff11000010fdc120 by task cat/870
CPU: 1 UID: 0 PID: 870 Comm: cat Not tainted 6.12.0-rc3+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 Call Trace: TASK dumpstacklvl+0x53/0x70 printaddressdescription.constprop.0+0x2c/0x3a0 printreport+0xb9/0x280 kasanreport+0xae/0xe0 svcexportshow+0x362/0x430 [nfsd] cshow+0x161/0x390 [sunrpc] seqreaditer+0x589/0x770 seqread+0x1e5/0x270 procregread+0xe1/0x140 vfsread+0x125/0x530 ksysread+0xc1/0x160 dosyscall64+0x5f/0x170 entrySYSCALL64afterhwframe+0x76/0x7e
Allocated by task 830: kasansavestack+0x20/0x40 kasansavetrack+0x14/0x30 kasankmalloc+0x8f/0xa0 kmallocnodetrackcallernoprof+0x1bc/0x400 kmemdupnoprof+0x22/0x50 svcexportparse+0x8a9/0xb80 [nfsd] cachedodowncall+0x71/0xa0 [sunrpc] cachewriteprocfs+0x8e/0xd0 [sunrpc] procregwrite+0xe1/0x140 vfswrite+0x1a5/0x6d0 ksyswrite+0xc1/0x160 dosyscall64+0x5f/0x170 entrySYSCALL64afterhwframe+0x76/0x7e
Freed by task 868: kasansavestack+0x20/0x40 kasansavetrack+0x14/0x30 kasansavefreeinfo+0x3b/0x60 kasanslabfree+0x37/0x50 kfree+0xf3/0x3e0 svcexportput+0x87/0xb0 [nfsd] cachepurge+0x17f/0x1f0 [sunrpc] nfsddestroyserv+0x226/0x2d0 [nfsd] nfsdsvc+0x125/0x1e0 [nfsd] writethreads+0x16a/0x2a0 [nfsd] nfsctltransactionwrite+0x74/0xa0 [nfsd] vfswrite+0x1a5/0x6d0 ksyswrite+0xc1/0x160 dosyscall64+0x5f/0x170 entrySYSCALL64afterhwframe+0x76/0x7e
2. We cannot sleep while using rcureadlock/rcureadunlock. However, svcexportput/expkeyput will call pathput, which subsequently triggers a sleeping operation due to the following dput.
============================= WARNING: suspicious RCU usage 5.10.0-dirty #141 Not tainted ----------------------------- ... Call Trace: dumpstack+0x9a/0xd0 mightsleep+0x231/0x240 dput+0x39/0x600 pathput+0x1b/0x30 svcexportput+0x17/0x80 eshow+0x1c9/0x200 seqreaditer+0x63f/0x7c0 seqread+0x226/0x2d0 vfsread+0x113/0x2c0 ksysread+0xc9/0x170 dosyscall64+0x33/0x40 entrySYSCALL64afterhwframe+0x67/0xd1
Fix these issues by using rcuwork to help release svcexpkey/svcexport. This approach allows for an asynchronous context to invoke pathput and also facilitates the freeing of uuid/exp/key after an RCU grace period.
— IBM
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.25-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-53216?
CVE-2024-53216 is classified as a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2024-53216?
To fix CVE-2024-53216, update the Linux kernel to version 6.12.12-1 or 6.12.15-1 for Debian systems.
Which versions of the Linux kernel are affected by CVE-2024-53216?
CVE-2024-53216 affects versions of the Linux kernel from 5.10.0 up to, but not including, 6.12.0-rc3.
What components are involved in CVE-2024-53216?
CVE-2024-53216 involves the nfsd component and the handling of cache_head references within specific 'c_show' and 'e_show' functions.
Is CVE-2024-53216 exploitable?
While the specific exploitability of CVE-2024-53216 may vary, the nature of the vulnerability suggests that it could potentially lead to system issues if not mitigated.