CVE-2024-53171

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ubifs: authentication: Fix use-after-free in ubifs_tnc_end_commit

After an insertion in TNC, the tree might split and cause a node to

change its `znode->parent`. A further deletion of other nodes in the

tree (which also could free the nodes), the aforementioned node's

`znode->cparent` could still point to a freed node. This

`znode->cparent` may not be updated when getting nodes to commit in

`ubifs_tnc_start_commit()`. This could then trigger a use-after-free

when accessing the `znode->cparent` in `write_index()` in

`ubifs_tnc_end_commit()`.

This can be triggered by running

rm -f /etc/test-file.bin

dd if=/dev/urandom of=/etc/test-file.bin bs=1M count=60 conv=fsync

in a loop, and with `CONFIG_UBIFS_FS_AUTHENTICATION`. KASAN then

reports:

BUG: KASAN: use-after-free in ubifs_tnc_end_commit+0xa5c/0x1950

Write of size 32 at addr ffffff800a3af86c by task ubifs_bgt0_20/153

Call trace:

dump_backtrace+0x0/0x3

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References