CVE-2023-53608

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nilfs2: fix potential UAF of struct nilfs_sc_info in nilfs_segctor_thread()

The finalization of nilfs_segctor_thread() can race with

nilfs_segctor_kill_thread() which terminates that thread, potentially

causing a use-after-free BUG as KASAN detected.

At the end of nilfs_segctor_thread(), it assigns NULL to "sc_task" member

of "struct nilfs_sc_info" to indicate the thread has finished, and then

notifies nilfs_segctor_kill_thread() of this using waitqueue

"sc_wait_task" on the struct nilfs_sc_info.

However, here, immediately after the NULL assignment to "sc_task", it is

possible that nilfs_segctor_kill_thread() will detect it and return to

continue the deallocation, freeing the nilfs_sc_info structure before the

thread does the notification.

This fixes the issue by protecting the NULL assignment to "sc_task" and

its notification, with spinlock "sc_state_lock" of the struct

nilfs_sc_info. Since nilfs_segctor_kill_th

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References