CVE-2024-53216

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> nfsd: release svc_expkey/svc_export with rcu_work<br /> <br /> The last reference for `cache_head` can be reduced to zero in `c_show`<br /> and `e_show`(using `rcu_read_lock` and `rcu_read_unlock`). Consequently,<br /> `svc_export_put` and `expkey_put` will be invoked, leading to two<br /> issues:<br /> <br /> 1. The `svc_export_put` will directly free ex_uuid. However,<br /> `e_show`/`c_show` will access `ex_uuid` after `cache_put`, which can<br /> trigger a use-after-free issue, shown below.<br /> <br /> ==================================================================<br /> BUG: KASAN: slab-use-after-free in svc_export_show+0x362/0x430 [nfsd]<br /> Read of size 1 at addr ff11000010fdc120 by task cat/870<br /> <br /> CPU: 1 UID: 0 PID: 870 Comm: cat Not tainted 6.12.0-rc3+ #1<br /> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS<br /> 1.16.1-2.fc37 04/01/2014<br /> Call Trace:<br /> <br /> dump_stack_lvl+0x53/0x70<br /> print_address_description.constprop.0+0x2c/0x3a0<br /> print_report+0xb9/0x280<br /> kasan_report+0xae/0xe0<br /> svc_export_show+0x362/0x430 [nfsd]<br /> c_show+0x161/0x390 [sunrpc]<br /> seq_read_iter+0x589/0x770<br /> seq_read+0x1e5/0x270<br /> proc_reg_read+0xe1/0x140<br /> vfs_read+0x125/0x530<br /> ksys_read+0xc1/0x160<br /> do_syscall_64+0x5f/0x170<br /> entry_SYSCALL_64_after_hwframe+0x76/0x7e<br /> <br /> Allocated by task 830:<br /> kasan_save_stack+0x20/0x40<br /> kasan_save_track+0x14/0x30<br /> __kasan_kmalloc+0x8f/0xa0<br /> __kmalloc_node_track_caller_noprof+0x1bc/0x400<br /> kmemdup_noprof+0x22/0x50<br /> svc_export_parse+0x8a9/0xb80 [nfsd]<br /> cache_do_downcall+0x71/0xa0 [sunrpc]<br /> cache_write_procfs+0x8e/0xd0 [sunrpc]<br /> proc_reg_write+0xe1/0x140<br /> vfs_write+0x1a5/0x6d0<br /> ksys_write+0xc1/0x160<br /> do_syscall_64+0x5f/0x170<br /> entry_SYSCALL_64_after_hwframe+0x76/0x7e<br /> <br /> Freed by task 868:<br /> kasan_save_stack+0x20/0x40<br /> kasan_save_track+0x14/0x30<br /> kasan_save_free_info+0x3b/0x60<br /> __kasan_slab_free+0x37/0x50<br /> kfree+0xf3/0x3e0<br /> svc_export_put+0x87/0xb0 [nfsd]<br /> cache_purge+0x17f/0x1f0 [sunrpc]<br /> nfsd_destroy_serv+0x226/0x2d0 [nfsd]<br /> nfsd_svc+0x125/0x1e0 [nfsd]<br /> write_threads+0x16a/0x2a0 [nfsd]<br /> nfsctl_transaction_write+0x74/0xa0 [nfsd]<br /> vfs_write+0x1a5/0x6d0<br /> ksys_write+0xc1/0x160<br /> do_syscall_64+0x5f/0x170<br /> entry_SYSCALL_64_after_hwframe+0x76/0x7e<br /> <br /> 2. We cannot sleep while using `rcu_read_lock`/`rcu_read_unlock`.<br /> However, `svc_export_put`/`expkey_put` will call path_put, which<br /> subsequently triggers a sleeping operation due to the following<br /> `dput`.<br /> <br /> =============================<br /> WARNING: suspicious RCU usage<br /> 5.10.0-dirty #141 Not tainted<br /> -----------------------------<br /> ...<br /> Call Trace:<br /> dump_stack+0x9a/0xd0<br /> ___might_sleep+0x231/0x240<br /> dput+0x39/0x600<br /> path_put+0x1b/0x30<br /> svc_export_put+0x17/0x80<br /> e_show+0x1c9/0x200<br /> seq_read_iter+0x63f/0x7c0<br /> seq_read+0x226/0x2d0<br /> vfs_read+0x113/0x2c0<br /> ksys_read+0xc9/0x170<br /> do_syscall_64+0x33/0x40<br /> entry_SYSCALL_64_after_hwframe+0x67/0xd1<br /> <br /> Fix these issues by using `rcu_work` to help release<br /> `svc_expkey`/`svc_export`. This approach allows for an asynchronous<br /> context to invoke `path_put` and also facilitates the freeing of<br /> `uuid/exp/key` after an RCU grace period.