In the Linux kernel, the following vulnerability has been resolved:
nfsd: release svcexpkey/svcexport with rcu_work
The last reference for cache_head can be reduced to zero in c_show
and e_show(using rcu_read_lock and rcu_read_unlock). Consequently,
svc_export_put and expkey_put will be invoked, leading to two
issues:
The svc_export_put will directly free ex_uuid. However,
e_show/c_show will access ex_uuid after cache_put, which can
trigger a use-after-free issue, shown below.
================================================================== BUG: KASAN: slab-use-after-free in svcexportshow+0x362/0x430 [nfsd] Read of size 1 at addr ff11000010fdc120 by task cat/870
CPU: 1 UID: 0 PID: 870 Comm: cat Not tainted 6.12.0-rc3+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 Call Trace: <TASK> dumpstacklvl+0x53/0x70 printaddressdescription.constprop.0+0x2c/0x3a0 printreport+0xb9/0x280 kasanreport+0xae/0xe0 svcexportshow+0x362/0x430 [nfsd] cshow+0x161/0x390 [sunrpc] seqreaditer+0x589/0x770 seqread+0x1e5/0x270 procregread+0xe1/0x140 vfsread+0x125/0x530 ksysread+0xc1/0x160 dosyscall64+0x5f/0x170 entrySYSCALL64afterhwframe+0x76/0x7e
Allocated by task 830: kasansavestack+0x20/0x40 kasansavetrack+0x14/0x30 _kasankmalloc+0x8f/0xa0 _kmallocnodetrackcallernoprof+0x1bc/0x400 kmemdupnoprof+0x22/0x50 svcexportparse+0x8a9/0xb80 [nfsd] cachedodowncall+0x71/0xa0 [sunrpc] cachewriteprocfs+0x8e/0xd0 [sunrpc] procregwrite+0xe1/0x140 vfswrite+0x1a5/0x6d0 ksyswrite+0xc1/0x160 dosyscall64+0x5f/0x170 entrySYSCALL64afterhwframe+0x76/0x7e
Freed by task 868: kasansavestack+0x20/0x40 kasansavetrack+0x14/0x30 kasansavefreeinfo+0x3b/0x60 _kasanslabfree+0x37/0x50 kfree+0xf3/0x3e0 svcexportput+0x87/0xb0 [nfsd] cachepurge+0x17f/0x1f0 [sunrpc] nfsddestroyserv+0x226/0x2d0 [nfsd] nfsdsvc+0x125/0x1e0 [nfsd] writethreads+0x16a/0x2a0 [nfsd] nfsctltransactionwrite+0x74/0xa0 [nfsd] vfswrite+0x1a5/0x6d0 ksyswrite+0xc1/0x160 dosyscall64+0x5f/0x170 entrySYSCALL64after_hwframe+0x76/0x7e
We cannot sleep while using rcu_read_lock/rcu_read_unlock.
However, svc_export_put/expkey_put will call path_put, which
subsequently triggers a sleeping operation due to the following
dput.
============================= WARNING: suspicious RCU usage 5.10.0-dirty #141 Not tainted
... Call Trace: dumpstack+0x9a/0xd0 _mightsleep+0x231/0x240 dput+0x39/0x600 pathput+0x1b/0x30 svcexportput+0x17/0x80 eshow+0x1c9/0x200 seqreaditer+0x63f/0x7c0 seqread+0x226/0x2d0 vfsread+0x113/0x2c0 ksysread+0xc9/0x170 dosyscall64+0x33/0x40 entrySYSCALL64after_hwframe+0x67/0xd1
Fix these issues by using rcu_work to help release
svc_expkey/svc_export. This approach allows for an asynchronous
context to invoke path_put and also facilitates the freeing of
uuid/exp/key after an RCU grace period.
[
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"83855961551801796961031945441480811869",
"277909092788022268703380932070381570429",
"209915995027318062157897828767943788621",
"169535534555982206662094076920717487609",
"222166505625667250935282916371028987785",
"284722347286612368711552986300310760450",
"331645538579987453671059349162613354099",
"165846165798314345826579911118531943035"
],
"threshold": 0.9
},
"target": {
"file": "fs/nfsd/export.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f8c989a0c89a75d30f899a7cabdc14d72522bb8d",
"signature_version": "v1",
"id": "CVE-2024-53216-018dbdb1"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"83855961551801796961031945441480811869",
"277909092788022268703380932070381570429",
"209915995027318062157897828767943788621",
"169535534555982206662094076920717487609",
"222166505625667250935282916371028987785",
"284722347286612368711552986300310760450",
"268344258340972417240083383511130282604",
"314821114093738787458480729468315407612"
],
"threshold": 0.9
},
"target": {
"file": "fs/nfsd/export.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2e4854599200f4d021df8ae17e69221d7c149f3e",
"signature_version": "v1",
"id": "CVE-2024-53216-1baf7ddc"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"140083158645783270593078044957707324774",
"122407719176901550616068574954025641039",
"106516352844018764966693396503948179380",
"255000494006468964108658301142902174181",
"25991891719208552710163221012713016595",
"293543578530430202491548991211598543563",
"207866261857100449411428089640618152264",
"8187120838244855762508590268459766887",
"262637956846397732604431097729984739987",
"242330253572142299174720672141623119981",
"43350787567438941968881377962736056942",
"151849166233222701068352745482088899786",
"163548945520287524348127567070130362460",
"120520708510161302950384018467888997959",
"338388364048447064164606314807345765565",
"217029662038595536239658715270722540847",
"231019915034060392328919599974554561361",
"183707256700970475914783450886696588072",
"324747947503802409400844853237021571928",
"167183672363662605395523452991415570861",
"135583756816666065190242387463723291444",
"178433769591300477473338126210153487296",
"214293422442042465020346014247420465135",
"329448072005585978683262819794469893806"
],
"threshold": 0.9
},
"target": {
"file": "fs/nfsd/export.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bd8524148dd8c123334b066faa90590ba2ef8e6f",
"signature_version": "v1",
"id": "CVE-2024-53216-2afe020e"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"83855961551801796961031945441480811869",
"277909092788022268703380932070381570429",
"209915995027318062157897828767943788621",
"169535534555982206662094076920717487609",
"222166505625667250935282916371028987785",
"284722347286612368711552986300310760450",
"268344258340972417240083383511130282604",
"314821114093738787458480729468315407612"
],
"threshold": 0.9
},
"target": {
"file": "fs/nfsd/export.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bd8524148dd8c123334b066faa90590ba2ef8e6f",
"signature_version": "v1",
"id": "CVE-2024-53216-30415958"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 325.0,
"function_hash": "39076755205324808042870962827757681872"
},
"target": {
"file": "fs/nfsd/export.c",
"function": "expkey_put"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2e4854599200f4d021df8ae17e69221d7c149f3e",
"signature_version": "v1",
"id": "CVE-2024-53216-3de0cabf"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 344.0,
"function_hash": "14559630691615737065558161374226413337"
},
"target": {
"file": "fs/nfsd/export.c",
"function": "svc_export_put"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2e4854599200f4d021df8ae17e69221d7c149f3e",
"signature_version": "v1",
"id": "CVE-2024-53216-438798ec"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"140083158645783270593078044957707324774",
"122407719176901550616068574954025641039",
"106516352844018764966693396503948179380",
"255000494006468964108658301142902174181",
"25991891719208552710163221012713016595",
"293543578530430202491548991211598543563",
"207866261857100449411428089640618152264",
"8187120838244855762508590268459766887",
"262637956846397732604431097729984739987",
"242330253572142299174720672141623119981",
"43350787567438941968881377962736056942",
"257908082094888042436816530457582624741",
"163548945520287524348127567070130362460",
"120520708510161302950384018467888997959",
"338388364048447064164606314807345765565",
"217029662038595536239658715270722540847",
"231019915034060392328919599974554561361",
"183707256700970475914783450886696588072",
"324747947503802409400844853237021571928",
"167183672363662605395523452991415570861",
"135583756816666065190242387463723291444",
"178433769591300477473338126210153487296",
"214293422442042465020346014247420465135",
"329448072005585978683262819794469893806"
],
"threshold": 0.9
},
"target": {
"file": "fs/nfsd/export.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f8c989a0c89a75d30f899a7cabdc14d72522bb8d",
"signature_version": "v1",
"id": "CVE-2024-53216-6b507063"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"83855961551801796961031945441480811869",
"277909092788022268703380932070381570429",
"209915995027318062157897828767943788621",
"169535534555982206662094076920717487609",
"222166505625667250935282916371028987785",
"284722347286612368711552986300310760450",
"331645538579987453671059349162613354099",
"165846165798314345826579911118531943035"
],
"threshold": 0.9
},
"target": {
"file": "fs/nfsd/export.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ad4363a24a5746b257c0beb5d8cc68f9b62c173f",
"signature_version": "v1",
"id": "CVE-2024-53216-71c736f0"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 344.0,
"function_hash": "14559630691615737065558161374226413337"
},
"target": {
"file": "fs/nfsd/export.c",
"function": "svc_export_put"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f8c989a0c89a75d30f899a7cabdc14d72522bb8d",
"signature_version": "v1",
"id": "CVE-2024-53216-909f7862"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"140083158645783270593078044957707324774",
"122407719176901550616068574954025641039",
"106516352844018764966693396503948179380",
"255000494006468964108658301142902174181",
"25991891719208552710163221012713016595",
"293543578530430202491548991211598543563",
"207866261857100449411428089640618152264",
"8187120838244855762508590268459766887",
"262637956846397732604431097729984739987",
"242330253572142299174720672141623119981",
"43350787567438941968881377962736056942",
"257908082094888042436816530457582624741",
"163548945520287524348127567070130362460",
"120520708510161302950384018467888997959",
"338388364048447064164606314807345765565",
"217029662038595536239658715270722540847",
"231019915034060392328919599974554561361",
"183707256700970475914783450886696588072",
"324747947503802409400844853237021571928",
"167183672363662605395523452991415570861",
"135583756816666065190242387463723291444",
"178433769591300477473338126210153487296",
"214293422442042465020346014247420465135",
"329448072005585978683262819794469893806"
],
"threshold": 0.9
},
"target": {
"file": "fs/nfsd/export.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ad4363a24a5746b257c0beb5d8cc68f9b62c173f",
"signature_version": "v1",
"id": "CVE-2024-53216-a85b941b"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 344.0,
"function_hash": "14559630691615737065558161374226413337"
},
"target": {
"file": "fs/nfsd/export.c",
"function": "svc_export_put"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bd8524148dd8c123334b066faa90590ba2ef8e6f",
"signature_version": "v1",
"id": "CVE-2024-53216-ae8988cc"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 325.0,
"function_hash": "39076755205324808042870962827757681872"
},
"target": {
"file": "fs/nfsd/export.c",
"function": "expkey_put"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f8c989a0c89a75d30f899a7cabdc14d72522bb8d",
"signature_version": "v1",
"id": "CVE-2024-53216-bb6f986c"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 325.0,
"function_hash": "39076755205324808042870962827757681872"
},
"target": {
"file": "fs/nfsd/export.c",
"function": "expkey_put"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ad4363a24a5746b257c0beb5d8cc68f9b62c173f",
"signature_version": "v1",
"id": "CVE-2024-53216-bec3afe1"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"140083158645783270593078044957707324774",
"122407719176901550616068574954025641039",
"106516352844018764966693396503948179380",
"255000494006468964108658301142902174181",
"25991891719208552710163221012713016595",
"293543578530430202491548991211598543563",
"207866261857100449411428089640618152264",
"8187120838244855762508590268459766887",
"262637956846397732604431097729984739987",
"242330253572142299174720672141623119981",
"43350787567438941968881377962736056942",
"257908082094888042436816530457582624741",
"163548945520287524348127567070130362460",
"120520708510161302950384018467888997959",
"338388364048447064164606314807345765565",
"217029662038595536239658715270722540847",
"231019915034060392328919599974554561361",
"183707256700970475914783450886696588072",
"324747947503802409400844853237021571928",
"167183672363662605395523452991415570861",
"135583756816666065190242387463723291444",
"178433769591300477473338126210153487296",
"214293422442042465020346014247420465135",
"329448072005585978683262819794469893806"
],
"threshold": 0.9
},
"target": {
"file": "fs/nfsd/export.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2e4854599200f4d021df8ae17e69221d7c149f3e",
"signature_version": "v1",
"id": "CVE-2024-53216-dd38f415"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 325.0,
"function_hash": "39076755205324808042870962827757681872"
},
"target": {
"file": "fs/nfsd/export.c",
"function": "expkey_put"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bd8524148dd8c123334b066faa90590ba2ef8e6f",
"signature_version": "v1",
"id": "CVE-2024-53216-e2c629cd"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 344.0,
"function_hash": "14559630691615737065558161374226413337"
},
"target": {
"file": "fs/nfsd/export.c",
"function": "svc_export_put"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ad4363a24a5746b257c0beb5d8cc68f9b62c173f",
"signature_version": "v1",
"id": "CVE-2024-53216-fc1bf219"
}
]