CVE-2024-27031

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

NFS: Fix nfs_netfs_issue_read() xarray locking for writeback interrupt

The loop inside nfs_netfs_issue_read() currently does not disable

interrupts while iterating through pages in the xarray to submit

for NFS read. This is not safe though since after taking xa_lock,

another page in the mapping could be processed for writeback inside

an interrupt, and deadlock can occur. The fix is simple and clean

if we use xa_for_each_range(), which handles the iteration with RCU

while reducing code complexity.

The problem is easily reproduced with the following test:

mount -o vers=3,fsc 127.0.0.1:/export /mnt/nfs

dd if=/dev/zero of=/mnt/nfs/file1.bin bs=4096 count=1

echo 3 > /proc/sys/vm/drop_caches

dd if=/mnt/nfs/file1.bin of=/dev/null

umount /mnt/nfs

On the console with a lockdep-enabled kernel a message similar to

the following will be seen:

================================

WARNING: inconsistent lock state

6.7.0-lo

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References