CVE-2024-50121: nfsd: cancel nfsd_shrinker_work using sync mode in nfs4_state_shutdown_net
In the Linux kernel, the following vulnerability has been resolved:
nfsd: cancel nfsdshrinkerwork using sync mode in nfs4stateshutdownnet
In the normal case, when we excute echo 0 > /proc/fs/nfsd/threads, the function nfs4statedestroynet in nfs4stateshutdownnet will release all resources related to the hashed nfs4client. If the nfsdclientshrinker is running concurrently, the expireclient function will first unhash this client and then destroy it. This can lead to the following warning. Additionally, numerous use-after-free errors may occur as well.
nfsdclientshrinker echo 0 > /proc/fs/nfsd/threads
expireclient nfsdshutdownnet unhashclient ... nfs4stateshutdownnet / won't wait shrinker exit / / cancelwork(&nn->nfsdshrinkerwork) nfsdfile for this / won't destroy unhashed client1 / client1 still alive nfs4statedestroynet /
nfsdfilecacheshutdown / trigger warning / kmemcachedestroy(nfsdfileslab) kmemcachedestroy(nfsdfilemarkslab) / release nfsdfile and mark / destroyclient
==================================================================== BUG nfsdfile (Not tainted): Objects remaining in nfsdfile on kmemcacheshutdown() -------------------------------------------------------------------- CPU: 4 UID: 0 PID: 764 Comm: sh Not tainted 6.12.0-rc3+ #1
dumpstacklvl+0x53/0x70 slaberr+0xb0/0xf0 kmemcacheshutdown+0x15c/0x310 kmemcachedestroy+0x66/0x160 nfsdfilecacheshutdown+0xac/0x210 [nfsd] nfsddestroyserv+0x251/0x2a0 [nfsd] nfsdsvc+0x125/0x1e0 [nfsd] writethreads+0x16a/0x2a0 [nfsd] nfsctltransactionwrite+0x74/0xa0 [nfsd] vfswrite+0x1a5/0x6d0 ksyswrite+0xc1/0x160 dosyscall64+0x5f/0x170 entrySYSCALL64afterhwframe+0x76/0x7e
==================================================================== BUG nfsdfilemark (Tainted: G B W ): Objects remaining nfsdfilemark on kmemcacheshutdown() --------------------------------------------------------------------
dumpstacklvl+0x53/0x70 slaberr+0xb0/0xf0 kmemcacheshutdown+0x15c/0x310 kmemcachedestroy+0x66/0x160 nfsdfilecacheshutdown+0xc8/0x210 [nfsd] nfsddestroyserv+0x251/0x2a0 [nfsd] nfsdsvc+0x125/0x1e0 [nfsd] writethreads+0x16a/0x2a0 [nfsd] nfsctltransactionwrite+0x74/0xa0 [nfsd] vfswrite+0x1a5/0x6d0 ksyswrite+0xc1/0x160 dosyscall64+0x5f/0x170 entrySYSCALL64afterhwframe+0x76/0x7e
To resolve this issue, cancel nfsdshrinkerwork using synchronous mode in nfs4stateshutdownnet.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
nfsd: cancel nfsdshrinkerwork using sync mode in nfs4stateshutdownnet
In the normal case, when we excute echo 0 > /proc/fs/nfsd/threads, the function nfs4statedestroynet in nfs4stateshutdownnet will release all resources related to the hashed nfs4client. If the nfsdclientshrinker is running concurrently, the expireclient function will first unhash this client and then destroy it. This can lead to the following warning. Additionally, numerous use-after-free errors may occur as well.
nfsdclientshrinker echo 0 > /proc/fs/nfsd/threads
expireclient nfsdshutdownnet unhashclient ... nfs4stateshutdownnet / won't wait shrinker exit / / cancelwork(&nn->nfsdshrinkerwork) nfsdfile for this / won't destroy unhashed client1 / client1 still alive nfs4statedestroynet /
nfsdfilecacheshutdown / trigger warning / kmemcachedestroy(nfsdfileslab) kmemcachedestroy(nfsdfilemarkslab) / release nfsdfile and mark / destroyclient
==================================================================== BUG nfsdfile (Not tainted): Objects remaining in nfsdfile on kmemcacheshutdown() -------------------------------------------------------------------- CPU: 4 UID: 0 PID: 764 Comm: sh Not tainted 6.12.0-rc3+ #1
dumpstacklvl+0x53/0x70 slaberr+0xb0/0xf0 kmemcacheshutdown+0x15c/0x310 kmemcachedestroy+0x66/0x160 nfsdfilecacheshutdown+0xac/0x210 [nfsd] nfsddestroyserv+0x251/0x2a0 [nfsd] nfsdsvc+0x125/0x1e0 [nfsd] writethreads+0x16a/0x2a0 [nfsd] nfsctltransactionwrite+0x74/0xa0 [nfsd] vfswrite+0x1a5/0x6d0 ksyswrite+0xc1/0x160 dosyscall64+0x5f/0x170 entrySYSCALL64afterhwframe+0x76/0x7e
==================================================================== BUG nfsdfilemark (Tainted: G B W ): Objects remaining nfsdfilemark on kmemcacheshutdown() --------------------------------------------------------------------
dumpstacklvl+0x53/0x70 slaberr+0xb0/0xf0 kmemcacheshutdown+0x15c/0x310 kmemcachedestroy+0x66/0x160 nfsdfilecacheshutdown+0xc8/0x210 [nfsd] nfsddestroyserv+0x251/0x2a0 [nfsd] nfsdsvc+0x125/0x1e0 [nfsd] writethreads+0x16a/0x2a0 [nfsd] nfsctltransactionwrite+0x74/0xa0 [nfsd] vfswrite+0x1a5/0x6d0 ksyswrite+0xc1/0x160 dosyscall64+0x5f/0x170 entrySYSCALL64afterhwframe+0x76/0x7e
To resolve this issue, cancel nfsdshrinkerwork using synchronous mode in nfs4stateshutdownnet.
— NVD
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50121?
CVE-2024-50121 is classified as a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2024-50121?
To fix CVE-2024-50121, you should update your Linux kernel to a version higher than 6.12-rc4 or apply the relevant patches from the Linux maintainers.
Which Linux kernel versions are affected by CVE-2024-50121?
CVE-2024-50121 affects Linux kernel versions from 5.10.220 up to 6.12-rc4 inclusive.
Is CVE-2024-50121 a remote execution vulnerability?
CVE-2024-50121 does not appear to be a remote code execution vulnerability; it is related to the NFS daemon and state management.
What components of the Linux kernel are impacted by CVE-2024-50121?
CVE-2024-50121 impacts the NFS subsystem, specifically related to the handling of nfsd_shrinker_work in the kernel.