Use-After-Free and RCU Lock Issues in Linux Kernel NFS Daemon
Summary
CVE-2024-53216: In the Linux kernel, the following vulnerability has been resolved: nfsd: release svc_expkey/svc_export with rcu_work The last reference for cache_head can be reduced to zero in c_show and e_show(using rcu_read_lock and... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. It supports various functionalities, including file systems, process management, and network protocols. The NFS (Network File System) daemon is a critical part of the kernel that allows file sharing over a network. This vulnerability affects the NFS daemon, specifically in how it manages memory and handles requests, potentially leading to severe security risks.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the NFS daemon (nfsd) related to improper memory management. The issue arises when the last reference for 'cache_head' is reduced to zero during the execution of 'c_show' and 'e_show' functions. This can lead to a use-after-free condition where the 'svc_export_put' function frees the 'ex_uuid' memory, but subsequent access to this memory by 'e_show' or 'c_show' can cause undefined behavior. Additionally, the use of 'rcu_read_lock' and 'rcu_read_unlock' prevents sleeping operations, but 'svc_export_put' calls 'path_put', which can trigger a sleeping operation, leading to further complications.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is advisable to apply the patch as soon as it becomes available.
Conclusion
The identified vulnerability in the Linux kernel's NFS daemon poses significant risks due to improper memory management, leading to potential use-after-free conditions and RCU lock issues. It is crucial for users to update their systems to the patched version to mitigate these risks and ensure system stability.
See every vulnerability recorded for linux →
FAQ
A use-after-free vulnerability occurs when a program continues to use a memory reference after it has been freed, potentially leading to crashes or arbitrary code execution.
This vulnerability can lead to memory corruption and instability in the NFS daemon, which could be exploited by attackers to gain unauthorized access or disrupt services.
Exploitation of this vulnerability could result in system crashes, data loss, or unauthorized access to sensitive information.
Yes, you can use Vulert to monitor and alert for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground at Vulert Scanner.
Regularly check security advisories, subscribe to vulnerability databases, and use tools like Vulert to monitor your dependencies for known vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
