In the Linux kernel, the following vulnerability has been resolved:
nilfs2: fix potential UAF of struct nilfsscinfo in nilfssegctorthread()
The finalization of nilfssegctorthread() can race with nilfssegctorkill_thread() which terminates that thread, potentially causing a use-after-free BUG as KASAN detected.
At the end of nilfssegctorthread(), it assigns NULL to "sctask" member of "struct nilfsscinfo" to indicate the thread has finished, and then notifies nilfssegctorkillthread() of this using waitqueue "scwaittask" on the struct nilfsscinfo.
However, here, immediately after the NULL assignment to "sctask", it is possible that nilfssegctorkillthread() will detect it and return to continue the deallocation, freeing the nilfsscinfo structure before the thread does the notification.
This fixes the issue by protecting the NULL assignment to "sctask" and its notification, with spinlock "scstatelock" of the struct nilfsscinfo. Since nilfssegctorkillthread() does a final check to see if "sctask" is NULL with "scstate_lock" locked, this can eliminate the race.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53608.json",
"cna_assigner": "Linux"
}[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f32297dba338dc06d62286dedb3cdbd5175b1719",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "fs/nilfs2/segment.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"117141074471901613265442835747098390338",
"235541330948003422738248468382110011782",
"161348816394519628643646486130620643850",
"51301780748659126105498349734950986203",
"16518835865254334966791150874122680508",
"280708176522569383324568797664273872568"
]
},
"signature_version": "v1",
"id": "CVE-2023-53608-082de2ec"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@034cce77d52ba013ce62b4f5258c29907eb1ada5",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "fs/nilfs2/segment.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"117141074471901613265442835747098390338",
"235541330948003422738248468382110011782",
"161348816394519628643646486130620643850",
"51301780748659126105498349734950986203",
"16518835865254334966791150874122680508",
"280708176522569383324568797664273872568"
]
},
"signature_version": "v1",
"id": "CVE-2023-53608-27190e5f"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b4d80bd6370b81a1725b6b8f7894802c23a14e9f",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "fs/nilfs2/segment.c",
"function": "nilfs_segctor_thread"
},
"digest": {
"length": 1714.0,
"function_hash": "2859406534409593286154043996761016089"
},
"signature_version": "v1",
"id": "CVE-2023-53608-2dad4bdb"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b4d80bd6370b81a1725b6b8f7894802c23a14e9f",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "fs/nilfs2/segment.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"117141074471901613265442835747098390338",
"235541330948003422738248468382110011782",
"161348816394519628643646486130620643850",
"51301780748659126105498349734950986203",
"16518835865254334966791150874122680508",
"280708176522569383324568797664273872568"
]
},
"signature_version": "v1",
"id": "CVE-2023-53608-30876d67"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@034cce77d52ba013ce62b4f5258c29907eb1ada5",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "fs/nilfs2/segment.c",
"function": "nilfs_segctor_thread"
},
"digest": {
"length": 1805.0,
"function_hash": "239794845527325150847049071669607286897"
},
"signature_version": "v1",
"id": "CVE-2023-53608-3a0aa44e"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@92684e02654c91a61a0b0561433b710bcece19fe",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "fs/nilfs2/segment.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"117141074471901613265442835747098390338",
"235541330948003422738248468382110011782",
"161348816394519628643646486130620643850",
"51301780748659126105498349734950986203",
"16518835865254334966791150874122680508",
"280708176522569383324568797664273872568"
]
},
"signature_version": "v1",
"id": "CVE-2023-53608-434c8b83"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6be49d100c22ffea3287a4b19d7639d259888e33",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "fs/nilfs2/segment.c",
"function": "nilfs_segctor_thread"
},
"digest": {
"length": 1714.0,
"function_hash": "2859406534409593286154043996761016089"
},
"signature_version": "v1",
"id": "CVE-2023-53608-4cdc6e0d"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bae009a2f1b7c2011d2e92d8c84868d315c0b97e",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "fs/nilfs2/segment.c",
"function": "nilfs_segctor_thread"
},
"digest": {
"length": 1714.0,
"function_hash": "2859406534409593286154043996761016089"
},
"signature_version": "v1",
"id": "CVE-2023-53608-5d18750a"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6be49d100c22ffea3287a4b19d7639d259888e33",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "fs/nilfs2/segment.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"117141074471901613265442835747098390338",
"235541330948003422738248468382110011782",
"161348816394519628643646486130620643850",
"51301780748659126105498349734950986203",
"16518835865254334966791150874122680508",
"280708176522569383324568797664273872568"
]
},
"signature_version": "v1",
"id": "CVE-2023-53608-7b8a6a87"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f32297dba338dc06d62286dedb3cdbd5175b1719",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "fs/nilfs2/segment.c",
"function": "nilfs_segctor_thread"
},
"digest": {
"length": 1714.0,
"function_hash": "2859406534409593286154043996761016089"
},
"signature_version": "v1",
"id": "CVE-2023-53608-7c88fbd9"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0dbf0e64b91ee8fcb278aea93eb06fc7d56ecbcc",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "fs/nilfs2/segment.c",
"function": "nilfs_segctor_thread"
},
"digest": {
"length": 1726.0,
"function_hash": "326817672092917203915343574132939912897"
},
"signature_version": "v1",
"id": "CVE-2023-53608-903e847a"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0dbf0e64b91ee8fcb278aea93eb06fc7d56ecbcc",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "fs/nilfs2/segment.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"117141074471901613265442835747098390338",
"235541330948003422738248468382110011782",
"161348816394519628643646486130620643850",
"51301780748659126105498349734950986203",
"16518835865254334966791150874122680508",
"280708176522569383324568797664273872568"
]
},
"signature_version": "v1",
"id": "CVE-2023-53608-aaf84f0a"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@92684e02654c91a61a0b0561433b710bcece19fe",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "fs/nilfs2/segment.c",
"function": "nilfs_segctor_thread"
},
"digest": {
"length": 1714.0,
"function_hash": "2859406534409593286154043996761016089"
},
"signature_version": "v1",
"id": "CVE-2023-53608-b54c8788"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@613bf23c070d11c525268f2945aa594704a9b764",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "fs/nilfs2/segment.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"117141074471901613265442835747098390338",
"235541330948003422738248468382110011782",
"161348816394519628643646486130620643850",
"51301780748659126105498349734950986203",
"16518835865254334966791150874122680508",
"280708176522569383324568797664273872568"
]
},
"signature_version": "v1",
"id": "CVE-2023-53608-d364d17e"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bae009a2f1b7c2011d2e92d8c84868d315c0b97e",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "fs/nilfs2/segment.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"117141074471901613265442835747098390338",
"235541330948003422738248468382110011782",
"161348816394519628643646486130620643850",
"51301780748659126105498349734950986203",
"16518835865254334966791150874122680508",
"280708176522569383324568797664273872568"
]
},
"signature_version": "v1",
"id": "CVE-2023-53608-da971da5"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@613bf23c070d11c525268f2945aa594704a9b764",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "fs/nilfs2/segment.c",
"function": "nilfs_segctor_thread"
},
"digest": {
"length": 1726.0,
"function_hash": "326817672092917203915343574132939912897"
},
"signature_version": "v1",
"id": "CVE-2023-53608-f65c3e7d"
}
]
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-53608.json"