CVE-2024-53167: nfs/blocklayout: Don't attempt unregister for invalid block device
In the Linux kernel, the following vulnerability has been resolved:
nfs/blocklayout: Don't attempt unregister for invalid block device
Since commit d869da91cccb ("nfs/blocklayout: Fix premature PR key unregistration") an unmount of a pNFS SCSI layout-enabled NFS may dereference a NULL blockdevice in:
blunregisterscsi+0x16/0xe0 [blocklayoutdriver] blfreedevice+0x70/0x80 [blocklayoutdriver] blfreedeviceidnode+0x12/0x30 [blocklayoutdriver] nfs4putdeviceidnode+0x60/0xc0 [nfsv4] nfs4deviceidpurgeclient+0x132/0x190 [nfsv4] unsetpnfslayoutdriver+0x59/0x60 [nfsv4] nfs4destroyserver+0x36/0x70 [nfsv4] nfsfreeserver+0x23/0xe0 [nfs] deactivatelockedsuper+0x30/0xb0 cleanupmnt+0xba/0x150 taskworkrun+0x59/0x90 syscallexittousermode+0x217/0x220 dosyscall64+0x8e/0x160
This happens because even though we were able to create the nfs4deviceidnode, the lookup for the device was unable to attach the block device to the pnfsblockdev.
If we never found a block device to register, we can avoid this case with the PNFSBDEVREGISTERED flag. Move the deref behind the test for the flag.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1 - Configuration
Ensure the kernel dereferences/unregisters the pNFS SCSI block device only after testing the PNFS_BDEV_REGISTERED flag (so an unmount does not attempt unregister for an invalid/NULL block device).
Linux kernel pNFS blocklayout (nfs/blocklayout) PNFS_BDEV_REGISTERED flag = Use PNFS_BDEV_REGISTERED to guard block device unregistration/cleanup
Event History
Frequently Asked Questions
What is the severity of CVE-2024-53167?
CVE-2024-53167 has been classified as a medium severity vulnerability.
What impact does CVE-2024-53167 have on affected systems?
CVE-2024-53167 may cause dereferencing issues during the unmount of a pNFS SCSI layout-enabled NFS.
How do I fix CVE-2024-53167?
To mitigate CVE-2024-53167, update the Linux kernel to the latest stable version that includes the fix.
Which versions of the Linux kernel are affected by CVE-2024-53167?
CVE-2024-53167 affects versions of the Linux kernel prior to the fix being applied in the stable update.
Is CVE-2024-53167 part of any known exploitation attempts?
As of now, there are no known active exploitation attempts specific to CVE-2024-53167.