Executive brief
The Linux kernel's nilfs2 filesystem implementation contains a race condition in its segment constructor thread cleanup that can cause a use-after-free vulnerability. An attacker with local access to a system using nilfs2 could exploit this to crash the kernel or potentially execute arbitrary code, affecting system availability and integrity.
Technical details
The vulnerability is a use-after-free (UAF) race condition in the nilfs2 filesystem's segctor thread cleanup logic. The race occurs between nilfs_segctor_thread() finishing and nilfs_segctor_kill_thread() terminating it: after sc_task is set to NULL to signal thread completion, nilfs_segctor_kill_thread() can detect this and deallocate the nilfs_sc_info structure before the thread completes its notification via waitqueue wake_up(). The fix protects both the NULL assignment to sc_task and the subsequent wake_up() call with spinlock sc_state_lock, and ensures nilfs_segctor_kill_thread() performs a final NULL check under the same lock to eliminate the race. This is a local kernel memory safety issue requiring local access to trigger.
Affected products
- Linux Linux Kernel All versions with nilfs2 filesystem support (affected by race condition in segment constructor thread, patch applied in 2023-03-28)
Timeline
- 2023-03-28: disclosed: Patch authored by Ryusuke Konishi
- 2023-04-20: patched: Fix committed to stable kernel trees