CVE-2024-53216

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: release svc_expkey/svc_export with rcu_work

The last reference for `cache_head` can be reduced to zero in `c_show`

and `e_show`(using `rcu_read_lock` and `rcu_read_unlock`). Consequently,

`svc_export_put` and `expkey_put` will be invoked, leading to two

issues:

1. The `svc_export_put` will directly free ex_uuid. However,

`e_show`/`c_show` will access `ex_uuid` after `cache_put`, which can

trigger a use-after-free issue, shown below.

==================================================================

BUG: KASAN: slab-use-after-free in svc_export_show+0x362/0x430 [nfsd]

Read of size 1 at addr ff11000010fdc120 by task cat/870

CPU: 1 UID: 0 PID: 870 Comm: cat Not tainted 6.12.0-rc3+ #1

Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS

1.16.1-2.fc37 04/01/2014

Call Trace:

<TASK>

dump_stack_lvl+0x53/0x70

print_address_description.constprop.0+0x2c/0x3a0

print_repo

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References