In the Linux kernel, the following vulnerability has been resolved:
nilfs2: fix potential use after free in nilfsgccachesubmitreaddata()
In nilfsgccachesubmitreaddata(), brelse(bh) is called to drop the reference count of bh when the call to nilfsdattranslate() fails. If the reference count hits 0 and its owner page gets unlocked, bh may be freed. However, bh->b_page is dereferenced to put the page after that, which may result in a use-after-free bug. This patch moves the release operation after unlocking and putting the page.
NOTE: The function in question is only called in GC, and in combination with current userland tools, address translation using DAT does not occur in that function, so the code path that causes this issue will not be executed. However, it is possible to run that code path by intentionally modifying the userland GC library or by calling the GC ioctl directly.
[konishi.ryusuke@gmail.com: NOTE added to the commit log]
[
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"325849370894738638707069174942931328648",
"322959535037126589595579996734252751126",
"251432405435936047371801430570002942647",
"156480260874977253751829908217559646941",
"159082015533581527805757003523093881502",
"51917116172339009522315761007138481903",
"127828113791559020846595995550939803443",
"207324864095962733314429349062067358852",
"103139784829333085616807563916596007234",
"232062342632494044599633714348469701387",
"229822151315753955514212476761537437684"
]
},
"target": {
"file": "fs/nilfs2/gcinode.c"
},
"id": "CVE-2023-52566-142f3d64",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3936e8714907cd55e37c7cc50e50229e4a9042e8",
"signature_type": "Line"
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"325849370894738638707069174942931328648",
"322959535037126589595579996734252751126",
"251432405435936047371801430570002942647",
"156480260874977253751829908217559646941",
"159082015533581527805757003523093881502",
"51917116172339009522315761007138481903",
"127828113791559020846595995550939803443",
"207324864095962733314429349062067358852",
"103139784829333085616807563916596007234",
"232062342632494044599633714348469701387",
"229822151315753955514212476761537437684"
]
},
"target": {
"file": "fs/nilfs2/gcinode.c"
},
"id": "CVE-2023-52566-2ba1c16a",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fb1084e63ee56958b0a56e17a50a4fd86445b9c1",
"signature_type": "Line"
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"325849370894738638707069174942931328648",
"322959535037126589595579996734252751126",
"251432405435936047371801430570002942647",
"156480260874977253751829908217559646941",
"159082015533581527805757003523093881502",
"51917116172339009522315761007138481903",
"127828113791559020846595995550939803443",
"207324864095962733314429349062067358852",
"103139784829333085616807563916596007234",
"232062342632494044599633714348469701387",
"229822151315753955514212476761537437684"
]
},
"target": {
"file": "fs/nilfs2/gcinode.c"
},
"id": "CVE-2023-52566-3bee988b",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bb61224f6abc8e71bfdf06d7c984e23460875f5b",
"signature_type": "Line"
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "131823324866153500024056177597336584764",
"length": 884.0
},
"target": {
"function": "nilfs_gccache_submit_read_data",
"file": "fs/nilfs2/gcinode.c"
},
"id": "CVE-2023-52566-3e3cdc35",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@193b5a1c6c67c36b430989dc063fe7ea4e200a33",
"signature_type": "Function"
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "131823324866153500024056177597336584764",
"length": 884.0
},
"target": {
"function": "nilfs_gccache_submit_read_data",
"file": "fs/nilfs2/gcinode.c"
},
"id": "CVE-2023-52566-3fa836d1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fb1084e63ee56958b0a56e17a50a4fd86445b9c1",
"signature_type": "Function"
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "114760888536557724333452146157213543306",
"length": 880.0
},
"target": {
"function": "nilfs_gccache_submit_read_data",
"file": "fs/nilfs2/gcinode.c"
},
"id": "CVE-2023-52566-4a5e730e",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@28df4646ad8b433340772edc90ca709cdefc53e2",
"signature_type": "Function"
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"325849370894738638707069174942931328648",
"322959535037126589595579996734252751126",
"251432405435936047371801430570002942647",
"156480260874977253751829908217559646941",
"159082015533581527805757003523093881502",
"51917116172339009522315761007138481903",
"127828113791559020846595995550939803443",
"207324864095962733314429349062067358852",
"103139784829333085616807563916596007234",
"232062342632494044599633714348469701387",
"229822151315753955514212476761537437684"
]
},
"target": {
"file": "fs/nilfs2/gcinode.c"
},
"id": "CVE-2023-52566-72b89f63",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@193b5a1c6c67c36b430989dc063fe7ea4e200a33",
"signature_type": "Line"
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "114760888536557724333452146157213543306",
"length": 880.0
},
"target": {
"function": "nilfs_gccache_submit_read_data",
"file": "fs/nilfs2/gcinode.c"
},
"id": "CVE-2023-52566-73062ee4",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@980663f1d189eedafd18d80053d9cf3e2ceb5c8c",
"signature_type": "Function"
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "131823324866153500024056177597336584764",
"length": 884.0
},
"target": {
"function": "nilfs_gccache_submit_read_data",
"file": "fs/nilfs2/gcinode.c"
},
"id": "CVE-2023-52566-7be1e0c7",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7130a87ca32396eb9bf48b71a2d42259ae44c6c7",
"signature_type": "Function"
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"325849370894738638707069174942931328648",
"322959535037126589595579996734252751126",
"251432405435936047371801430570002942647",
"156480260874977253751829908217559646941",
"159082015533581527805757003523093881502",
"51917116172339009522315761007138481903",
"127828113791559020846595995550939803443",
"207324864095962733314429349062067358852",
"103139784829333085616807563916596007234",
"232062342632494044599633714348469701387",
"229822151315753955514212476761537437684"
]
},
"target": {
"file": "fs/nilfs2/gcinode.c"
},
"id": "CVE-2023-52566-84fdf60d",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@28df4646ad8b433340772edc90ca709cdefc53e2",
"signature_type": "Line"
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "131823324866153500024056177597336584764",
"length": 884.0
},
"target": {
"function": "nilfs_gccache_submit_read_data",
"file": "fs/nilfs2/gcinode.c"
},
"id": "CVE-2023-52566-8551742a",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3936e8714907cd55e37c7cc50e50229e4a9042e8",
"signature_type": "Function"
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"325849370894738638707069174942931328648",
"322959535037126589595579996734252751126",
"251432405435936047371801430570002942647",
"156480260874977253751829908217559646941",
"159082015533581527805757003523093881502",
"51917116172339009522315761007138481903",
"127828113791559020846595995550939803443",
"207324864095962733314429349062067358852",
"103139784829333085616807563916596007234",
"232062342632494044599633714348469701387",
"229822151315753955514212476761537437684"
]
},
"target": {
"file": "fs/nilfs2/gcinode.c"
},
"id": "CVE-2023-52566-86282cee",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7130a87ca32396eb9bf48b71a2d42259ae44c6c7",
"signature_type": "Line"
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"325849370894738638707069174942931328648",
"322959535037126589595579996734252751126",
"251432405435936047371801430570002942647",
"156480260874977253751829908217559646941",
"159082015533581527805757003523093881502",
"51917116172339009522315761007138481903",
"127828113791559020846595995550939803443",
"207324864095962733314429349062067358852",
"103139784829333085616807563916596007234",
"232062342632494044599633714348469701387",
"229822151315753955514212476761537437684"
]
},
"target": {
"file": "fs/nilfs2/gcinode.c"
},
"id": "CVE-2023-52566-a0cd8346",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@980663f1d189eedafd18d80053d9cf3e2ceb5c8c",
"signature_type": "Line"
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "114760888536557724333452146157213543306",
"length": 880.0
},
"target": {
"function": "nilfs_gccache_submit_read_data",
"file": "fs/nilfs2/gcinode.c"
},
"id": "CVE-2023-52566-ba7dada0",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7ee29facd8a9c5a26079148e36bcf07141b3a6bc",
"signature_type": "Function"
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"325849370894738638707069174942931328648",
"322959535037126589595579996734252751126",
"251432405435936047371801430570002942647",
"156480260874977253751829908217559646941",
"159082015533581527805757003523093881502",
"51917116172339009522315761007138481903",
"127828113791559020846595995550939803443",
"207324864095962733314429349062067358852",
"103139784829333085616807563916596007234",
"232062342632494044599633714348469701387",
"229822151315753955514212476761537437684"
]
},
"target": {
"file": "fs/nilfs2/gcinode.c"
},
"id": "CVE-2023-52566-e7400c90",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7ee29facd8a9c5a26079148e36bcf07141b3a6bc",
"signature_type": "Line"
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "131823324866153500024056177597336584764",
"length": 884.0
},
"target": {
"function": "nilfs_gccache_submit_read_data",
"file": "fs/nilfs2/gcinode.c"
},
"id": "CVE-2023-52566-e8803234",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bb61224f6abc8e71bfdf06d7c984e23460875f5b",
"signature_type": "Function"
}
]