CVE-2023-52803

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

SUNRPC: Fix RPC client cleaned up the freed pipefs dentries

RPC client pipefs dentries cleanup is in separated rpc_remove_pipedir()

workqueue,which takes care about pipefs superblock locking.

In some special scenarios, when kernel frees the pipefs sb of the

current client and immediately alloctes a new pipefs sb,

rpc_remove_pipedir function would misjudge the existence of pipefs

sb which is not the one it used to hold. As a result,

the rpc_remove_pipedir would clean the released freed pipefs dentries.

To fix this issue, rpc_remove_pipedir should check whether the

current pipefs sb is consistent with the original pipefs sb.

This error can be catched by KASAN:

=========================================================

[ 250.497700] BUG: KASAN: slab-use-after-free in dget_parent+0x195/0x200

[ 250.498315] Read of size 4 at addr ffff88800a2ab804 by task kworker/0:18/106503

[ 250.500549] Workqueue: events rpc_free_clie

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References