In the Linux kernel, the following vulnerability has been resolved:
SUNRPC: Fix RPC client cleaned up the freed pipefs dentries
RPC client pipefs dentries cleanup is in separated rpcremovepipedir() workqueue,which takes care about pipefs superblock locking. In some special scenarios, when kernel frees the pipefs sb of the current client and immediately alloctes a new pipefs sb, rpcremovepipedir function would misjudge the existence of pipefs sb which is not the one it used to hold. As a result, the rpcremovepipedir would clean the released freed pipefs dentries.
To fix this issue, rpcremovepipedir should check whether the current pipefs sb is consistent with the original pipefs sb.
[ 250.497700] BUG: KASAN: slab-use-after-free in dgetparent+0x195/0x200 [ 250.498315] Read of size 4 at addr ffff88800a2ab804 by task kworker/0:18/106503 [ 250.500549] Workqueue: events rpcfreeclientwork [ 250.501001] Call Trace: [ 250.502880] kasanreport+0xb6/0xf0 [ 250.503209] ? dgetparent+0x195/0x200 [ 250.503561] dgetparent+0x195/0x200 [ 250.503897] ? _pfxrpcclntdirdepopulate+0x10/0x10 [ 250.504384] rpcrmdirdepopulate+0x1b/0x90 [ 250.504781] rpcremoveclientdir+0xf5/0x150 [ 250.505195] rpcfreeclientwork+0xe4/0x230 [ 250.505598] processonework+0x8ee/0x13b0 ... [ 22.039056] Allocated by task 244: [ 22.039390] kasansavestack+0x22/0x50 [ 22.039758] kasansettrack+0x25/0x30 [ 22.040109] _kasanslaballoc+0x59/0x70 [ 22.040487] kmemcachealloclru+0xf0/0x240 [ 22.040889] _dalloc+0x31/0x8e0 [ 22.041207] dalloc+0x44/0x1f0 [ 22.041514] _rpclookupcreateexclusive+0x11c/0x140 [ 22.041987] rpcmkdirpopulate.constprop.0+0x5f/0x110 [ 22.042459] rpccreateclientdir+0x34/0x150 [ 22.042874] rpcsetuppipedirsb+0x102/0x1c0 [ 22.043284] rpcclientregister+0x136/0x4e0 [ 22.043689] rpcnewclient+0x911/0x1020 [ 22.044057] rpccreatexprt+0xcb/0x370 [ 22.044417] rpccreate+0x36b/0x6c0 ... [ 22.049524] Freed by task 0: [ 22.049803] kasansavestack+0x22/0x50 [ 22.050165] kasansettrack+0x25/0x30 [ 22.050520] kasansavefreeinfo+0x2b/0x50 [ 22.050921] _kasanslabfree+0x10e/0x1a0 [ 22.051306] kmemcachefree+0xa5/0x390 [ 22.051667] rcucore+0x62c/0x1930 [ 22.051995] _dosoftirq+0x165/0x52a [ 22.052347] [ 22.052503] Last potentially related work creation: [ 22.052952] kasansavestack+0x22/0x50 [ 22.053313] _kasanrecordauxstack+0x8e/0xa0 [ 22.053739] _callrcucommon.constprop.0+0x6b/0x8b0 [ 22.054209] dentryfree+0xb2/0x140 [ 22.054540] _dentrykill+0x3be/0x540 [ 22.054900] shrinkdentrylist+0x199/0x510 [ 22.055293] shrinkdcacheparent+0x190/0x240 [ 22.055703] doonetree+0x11/0x40 [ 22.056028] shrinkdcacheforumount+0x61/0x140 [ 22.056461] genericshutdownsuper+0x70/0x590 [ 22.056879] killanonsuper+0x3a/0x60 [ 22.057234] rpckill_sb+0x121/0x200
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7d61d1da2ed1f682c41cae0c8d4719cdaccee5c5",
"id": "CVE-2023-52803-10ec9df2",
"deprecated": false,
"target": {
"function": "rpc_clnt_remove_pipedir",
"file": "net/sunrpc/clnt.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 172.0,
"function_hash": "71873313309197525837696488778403004186"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cc2e7ebbeb1d0601f7f3c8d93b78fcc03a95e44a",
"id": "CVE-2023-52803-2669eeff",
"deprecated": false,
"target": {
"function": "rpc_setup_pipedir",
"file": "net/sunrpc/clnt.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 225.0,
"function_hash": "180646265501476861162017783366536742941"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@194454afa6aa9d6ed74f0c57127bc8beb27c20df",
"id": "CVE-2023-52803-2dfe94bc",
"deprecated": false,
"target": {
"file": "include/linux/sunrpc/clnt.h"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"88140423002225630762712234682076599416",
"206613558438104111271121924893286710555",
"37955075930183721353622369043319902174",
"337149948125900591151506300242322256364"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7d61d1da2ed1f682c41cae0c8d4719cdaccee5c5",
"id": "CVE-2023-52803-3a7b6cea",
"deprecated": false,
"target": {
"function": "rpc_setup_pipedir",
"file": "net/sunrpc/clnt.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 225.0,
"function_hash": "180646265501476861162017783366536742941"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7d61d1da2ed1f682c41cae0c8d4719cdaccee5c5",
"id": "CVE-2023-52803-3e96f893",
"deprecated": false,
"target": {
"file": "net/sunrpc/clnt.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"32820062821960282576617753668535653749",
"110490355793600632344778398874309740514",
"19878092648728613784548345575015328254",
"160472408846290526872655811276609195994",
"174431562808913842994968335804493606616",
"144349011470103708848532664098306826128",
"103873190562333246202332557199420600646"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7749fd2dbef72a52b5c9ffdbf877691950ed4680",
"id": "CVE-2023-52803-3f742e1a",
"deprecated": false,
"target": {
"file": "net/sunrpc/clnt.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"32820062821960282576617753668535653749",
"110490355793600632344778398874309740514",
"19878092648728613784548345575015328254",
"160472408846290526872655811276609195994",
"174431562808913842994968335804493606616",
"144349011470103708848532664098306826128",
"103873190562333246202332557199420600646"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7d61d1da2ed1f682c41cae0c8d4719cdaccee5c5",
"id": "CVE-2023-52803-426f96b4",
"deprecated": false,
"target": {
"file": "include/linux/sunrpc/clnt.h"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"175501047592767469662238220394093966078",
"91718145987495558371023558117364416270",
"8717006728866591855915869465390371518",
"292641483747273218506442906210428054520"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dedf2a0eb9448ae73b270743e6ea9b108189df46",
"id": "CVE-2023-52803-50d65f46",
"deprecated": false,
"target": {
"function": "rpc_setup_pipedir",
"file": "net/sunrpc/clnt.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 225.0,
"function_hash": "180646265501476861162017783366536742941"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bfca5fb4e97c46503ddfc582335917b0cc228264",
"id": "CVE-2023-52803-5a03fc85",
"deprecated": false,
"target": {
"function": "rpc_setup_pipedir",
"file": "net/sunrpc/clnt.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 225.0,
"function_hash": "180646265501476861162017783366536742941"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7749fd2dbef72a52b5c9ffdbf877691950ed4680",
"id": "CVE-2023-52803-5e2dedfe",
"deprecated": false,
"target": {
"function": "rpc_setup_pipedir",
"file": "net/sunrpc/clnt.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 225.0,
"function_hash": "180646265501476861162017783366536742941"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1cdb52ffd6600a37bd355d8dce58ecd03e55e618",
"id": "CVE-2023-52803-64c4d475",
"deprecated": false,
"target": {
"function": "rpc_clnt_remove_pipedir",
"file": "net/sunrpc/clnt.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 172.0,
"function_hash": "71873313309197525837696488778403004186"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dedf2a0eb9448ae73b270743e6ea9b108189df46",
"id": "CVE-2023-52803-6d016003",
"deprecated": false,
"target": {
"file": "net/sunrpc/clnt.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"32820062821960282576617753668535653749",
"110490355793600632344778398874309740514",
"19878092648728613784548345575015328254",
"160472408846290526872655811276609195994",
"174431562808913842994968335804493606616",
"144349011470103708848532664098306826128",
"103873190562333246202332557199420600646"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@194454afa6aa9d6ed74f0c57127bc8beb27c20df",
"id": "CVE-2023-52803-700eed17",
"deprecated": false,
"target": {
"function": "rpc_setup_pipedir",
"file": "net/sunrpc/clnt.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 225.0,
"function_hash": "180646265501476861162017783366536742941"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bfca5fb4e97c46503ddfc582335917b0cc228264",
"id": "CVE-2023-52803-769c1cee",
"deprecated": false,
"target": {
"file": "net/sunrpc/clnt.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"32820062821960282576617753668535653749",
"110490355793600632344778398874309740514",
"19878092648728613784548345575015328254",
"160472408846290526872655811276609195994",
"174431562808913842994968335804493606616",
"144349011470103708848532664098306826128",
"103873190562333246202332557199420600646"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dedf2a0eb9448ae73b270743e6ea9b108189df46",
"id": "CVE-2023-52803-79aa723c",
"deprecated": false,
"target": {
"function": "rpc_clnt_remove_pipedir",
"file": "net/sunrpc/clnt.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 172.0,
"function_hash": "71873313309197525837696488778403004186"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cc2e7ebbeb1d0601f7f3c8d93b78fcc03a95e44a",
"id": "CVE-2023-52803-7e11fb40",
"deprecated": false,
"target": {
"file": "net/sunrpc/clnt.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"32820062821960282576617753668535653749",
"110490355793600632344778398874309740514",
"19878092648728613784548345575015328254",
"160472408846290526872655811276609195994",
"174431562808913842994968335804493606616",
"144349011470103708848532664098306826128",
"103873190562333246202332557199420600646"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@17866066b8ac1cc38fb449670bc15dc9fee4b40a",
"id": "CVE-2023-52803-81261542",
"deprecated": false,
"target": {
"function": "rpc_setup_pipedir",
"file": "net/sunrpc/clnt.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 225.0,
"function_hash": "180646265501476861162017783366536742941"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@194454afa6aa9d6ed74f0c57127bc8beb27c20df",
"id": "CVE-2023-52803-91b56337",
"deprecated": false,
"target": {
"function": "rpc_clnt_remove_pipedir",
"file": "net/sunrpc/clnt.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 172.0,
"function_hash": "71873313309197525837696488778403004186"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@194454afa6aa9d6ed74f0c57127bc8beb27c20df",
"id": "CVE-2023-52803-96525aec",
"deprecated": false,
"target": {
"file": "net/sunrpc/clnt.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"32820062821960282576617753668535653749",
"110490355793600632344778398874309740514",
"19878092648728613784548345575015328254",
"160472408846290526872655811276609195994",
"174431562808913842994968335804493606616",
"144349011470103708848532664098306826128",
"103873190562333246202332557199420600646"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1cdb52ffd6600a37bd355d8dce58ecd03e55e618",
"id": "CVE-2023-52803-9f2c6655",
"deprecated": false,
"target": {
"file": "include/linux/sunrpc/clnt.h"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"88140423002225630762712234682076599416",
"206613558438104111271121924893286710555",
"37955075930183721353622369043319902174",
"337149948125900591151506300242322256364"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bfca5fb4e97c46503ddfc582335917b0cc228264",
"id": "CVE-2023-52803-9fbce03c",
"deprecated": false,
"target": {
"file": "include/linux/sunrpc/clnt.h"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"88140423002225630762712234682076599416",
"206613558438104111271121924893286710555",
"37955075930183721353622369043319902174",
"337149948125900591151506300242322256364"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@17866066b8ac1cc38fb449670bc15dc9fee4b40a",
"id": "CVE-2023-52803-a18d2b48",
"deprecated": false,
"target": {
"function": "rpc_clnt_remove_pipedir",
"file": "net/sunrpc/clnt.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 172.0,
"function_hash": "71873313309197525837696488778403004186"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bfca5fb4e97c46503ddfc582335917b0cc228264",
"id": "CVE-2023-52803-a87c7e36",
"deprecated": false,
"target": {
"function": "rpc_clnt_remove_pipedir",
"file": "net/sunrpc/clnt.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 172.0,
"function_hash": "71873313309197525837696488778403004186"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7749fd2dbef72a52b5c9ffdbf877691950ed4680",
"id": "CVE-2023-52803-c8968eea",
"deprecated": false,
"target": {
"file": "include/linux/sunrpc/clnt.h"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"88140423002225630762712234682076599416",
"206613558438104111271121924893286710555",
"37955075930183721353622369043319902174",
"337149948125900591151506300242322256364"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cc2e7ebbeb1d0601f7f3c8d93b78fcc03a95e44a",
"id": "CVE-2023-52803-db8d3611",
"deprecated": false,
"target": {
"file": "include/linux/sunrpc/clnt.h"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"88140423002225630762712234682076599416",
"206613558438104111271121924893286710555",
"37955075930183721353622369043319902174",
"337149948125900591151506300242322256364"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@17866066b8ac1cc38fb449670bc15dc9fee4b40a",
"id": "CVE-2023-52803-ecd63d94",
"deprecated": false,
"target": {
"file": "net/sunrpc/clnt.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"32820062821960282576617753668535653749",
"110490355793600632344778398874309740514",
"19878092648728613784548345575015328254",
"160472408846290526872655811276609195994",
"174431562808913842994968335804493606616",
"144349011470103708848532664098306826128",
"103873190562333246202332557199420600646"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@17866066b8ac1cc38fb449670bc15dc9fee4b40a",
"id": "CVE-2023-52803-f0afa886",
"deprecated": false,
"target": {
"file": "include/linux/sunrpc/clnt.h"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"260867434711687118987781021265058796723",
"306380616368830396937694122246882329560",
"155613449265843045128508912123328966269",
"216675650826965444362107516024773323170"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cc2e7ebbeb1d0601f7f3c8d93b78fcc03a95e44a",
"id": "CVE-2023-52803-f3d47083",
"deprecated": false,
"target": {
"function": "rpc_clnt_remove_pipedir",
"file": "net/sunrpc/clnt.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 172.0,
"function_hash": "71873313309197525837696488778403004186"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1cdb52ffd6600a37bd355d8dce58ecd03e55e618",
"id": "CVE-2023-52803-f4b8e4c7",
"deprecated": false,
"target": {
"function": "rpc_setup_pipedir",
"file": "net/sunrpc/clnt.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 225.0,
"function_hash": "180646265501476861162017783366536742941"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7749fd2dbef72a52b5c9ffdbf877691950ed4680",
"id": "CVE-2023-52803-f50e4733",
"deprecated": false,
"target": {
"function": "rpc_clnt_remove_pipedir",
"file": "net/sunrpc/clnt.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 172.0,
"function_hash": "71873313309197525837696488778403004186"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1cdb52ffd6600a37bd355d8dce58ecd03e55e618",
"id": "CVE-2023-52803-f5b80a6b",
"deprecated": false,
"target": {
"file": "net/sunrpc/clnt.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"32820062821960282576617753668535653749",
"110490355793600632344778398874309740514",
"19878092648728613784548345575015328254",
"160472408846290526872655811276609195994",
"174431562808913842994968335804493606616",
"144349011470103708848532664098306826128",
"103873190562333246202332557199420600646"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dedf2a0eb9448ae73b270743e6ea9b108189df46",
"id": "CVE-2023-52803-f86c6dae",
"deprecated": false,
"target": {
"file": "include/linux/sunrpc/clnt.h"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"301371842766091968671841265054616275241",
"162843802069063238988179859453513518761",
"28405709449645130780201326230446654732",
"292641483747273218506442906210428054520"
]
}
}
]