In the Linux kernel, the following vulnerability has been resolved:
nfsd: make sure exp active before svcexportshow
The function e_show was called with protection from RCU. This only
ensures that exp will not be freed. Therefore, the reference count for
exp can drop to zero, which will trigger a refcount use-after-free
warning when exp_get is called. To resolve this issue, use
cache_get_rcu to ensure that exp remains active.
------------[ cut here ]------------ refcountt: addition on 0; use-after-free. WARNING: CPU: 3 PID: 819 at lib/refcount.c:25 refcountwarnsaturate+0xb1/0x120 CPU: 3 UID: 0 PID: 819 Comm: cat Not tainted 6.12.0-rc3+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 RIP: 0010:refcountwarnsaturate+0xb1/0x120 ... Call Trace: <TASK> eshow+0x20b/0x230 [nfsd] seqreaditer+0x589/0x770 seqread+0x1e5/0x270 vfsread+0x125/0x530 ksysread+0xc1/0x160 dosyscall64+0x5f/0x170 entrySYSCALL64after_hwframe+0x76/0x7e
[
{
"id": "CVE-2024-56558-178b893d",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "fs/nfsd/export.c"
},
"digest": {
"line_hashes": [
"82145156651805844332560906853964155409",
"164386050634042249952164568726264937595",
"291712543761045200262113725319746253336",
"229637221771949380458172052710941851891",
"205207249191057254654129491772386852833",
"81296199963174941449840760278175732912"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e2fa0d0e327279a8defb87b263cd0bf288fd9261"
},
{
"id": "CVE-2024-56558-2839c755",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "fs/nfsd/export.c",
"function": "e_show"
},
"digest": {
"function_hash": "10061921698745176592206819963541156887",
"length": 573.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1cecfdbc6bfc89c516d286884c7f29267b95de2b"
},
{
"id": "CVE-2024-56558-2d323e8d",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "fs/nfsd/export.c"
},
"digest": {
"line_hashes": [
"82145156651805844332560906853964155409",
"164386050634042249952164568726264937595",
"291712543761045200262113725319746253336",
"229637221771949380458172052710941851891",
"205207249191057254654129491772386852833",
"81296199963174941449840760278175732912"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6cefcadd34e3c71c81ea64b899a0daa86314a51a"
},
{
"id": "CVE-2024-56558-382fc42d",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "fs/nfsd/export.c",
"function": "e_show"
},
"digest": {
"function_hash": "10061921698745176592206819963541156887",
"length": 573.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7365d1f8de63cffdbbaa2287ce0205438e1a922f"
},
{
"id": "CVE-2024-56558-863a7e06",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "fs/nfsd/export.c"
},
"digest": {
"line_hashes": [
"82145156651805844332560906853964155409",
"164386050634042249952164568726264937595",
"291712543761045200262113725319746253336",
"229637221771949380458172052710941851891",
"205207249191057254654129491772386852833",
"81296199963174941449840760278175732912"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@be8f982c369c965faffa198b46060f8853e0f1f0"
},
{
"id": "CVE-2024-56558-87c07504",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "fs/nfsd/export.c"
},
"digest": {
"line_hashes": [
"82145156651805844332560906853964155409",
"164386050634042249952164568726264937595",
"291712543761045200262113725319746253336",
"229637221771949380458172052710941851891",
"205207249191057254654129491772386852833",
"81296199963174941449840760278175732912"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7fd29d284b55c2274f7a748e6c5f25b4758b8da5"
},
{
"id": "CVE-2024-56558-a020bf01",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "fs/nfsd/export.c"
},
"digest": {
"line_hashes": [
"82145156651805844332560906853964155409",
"164386050634042249952164568726264937595",
"291712543761045200262113725319746253336",
"229637221771949380458172052710941851891",
"205207249191057254654129491772386852833",
"81296199963174941449840760278175732912"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7365d1f8de63cffdbbaa2287ce0205438e1a922f"
},
{
"id": "CVE-2024-56558-b61e604c",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "fs/nfsd/export.c"
},
"digest": {
"line_hashes": [
"82145156651805844332560906853964155409",
"164386050634042249952164568726264937595",
"291712543761045200262113725319746253336",
"229637221771949380458172052710941851891",
"205207249191057254654129491772386852833",
"81296199963174941449840760278175732912"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7d8f7816bebcd2e7400bb4d786eccb8f33c9f9ec"
},
{
"id": "CVE-2024-56558-baabbaa6",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "fs/nfsd/export.c",
"function": "e_show"
},
"digest": {
"function_hash": "10061921698745176592206819963541156887",
"length": 573.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6cefcadd34e3c71c81ea64b899a0daa86314a51a"
},
{
"id": "CVE-2024-56558-d6ab33c4",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "fs/nfsd/export.c",
"function": "e_show"
},
"digest": {
"function_hash": "10061921698745176592206819963541156887",
"length": 573.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7d8f7816bebcd2e7400bb4d786eccb8f33c9f9ec"
},
{
"id": "CVE-2024-56558-e0be9618",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "fs/nfsd/export.c",
"function": "e_show"
},
"digest": {
"function_hash": "224468379615744790175401866706242283828",
"length": 462.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e2fa0d0e327279a8defb87b263cd0bf288fd9261"
},
{
"id": "CVE-2024-56558-ec1f3f16",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "fs/nfsd/export.c"
},
"digest": {
"line_hashes": [
"82145156651805844332560906853964155409",
"164386050634042249952164568726264937595",
"291712543761045200262113725319746253336",
"229637221771949380458172052710941851891",
"205207249191057254654129491772386852833",
"81296199963174941449840760278175732912"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1cecfdbc6bfc89c516d286884c7f29267b95de2b"
},
{
"id": "CVE-2024-56558-eec39f82",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "fs/nfsd/export.c",
"function": "e_show"
},
"digest": {
"function_hash": "10061921698745176592206819963541156887",
"length": 573.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7fd29d284b55c2274f7a748e6c5f25b4758b8da5"
},
{
"id": "CVE-2024-56558-fddfbd89",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "fs/nfsd/export.c",
"function": "e_show"
},
"digest": {
"function_hash": "10061921698745176592206819963541156887",
"length": 573.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@be8f982c369c965faffa198b46060f8853e0f1f0"
}
]