CVE-2023-53311

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput

During unmount process of nilfs2, nothing holds nilfs_root structure after

nilfs2 detaches its writer in nilfs_detach_log_writer(). Previously,

nilfs_evict_inode() could cause use-after-free read for nilfs_root if

inodes are left in "garbage_list" and released by nilfs_dispose_list at

the end of nilfs_detach_log_writer(), and this bug was fixed by commit

9b5a04ac3ad9 ("nilfs2: fix use-after-free bug of nilfs_root in

nilfs_evict_inode()").

However, it turned out that there is another possibility of UAF in the

call path where mark_inode_dirty_sync() is called from iput():

nilfs_detach_log_writer()

nilfs_dispose_list()

iput()

mark_inode_dirty_sync()

__mark_inode_dirty()

nilfs_dirty_inode()

__nilfs_mark_inode_dirty()

nilfs_load_inode_block() --> causes UAF of nilfs_root struct

This can happen a

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References