Executive brief
The nilfs2 filesystem in the Linux kernel has a use-after-free vulnerability where previously cached filesystem metadata buffers may be discarded under certain conditions but then reused, causing kernel warnings or system crashes. This affects systems that use NILFS2 filesystems, particularly those handling corrupted or unusual disk images.
Technical details
The vulnerability is a use-after-free condition in the nilfs2 filesystem driver's metadata buffer management. The root cause is that nilfs2 maintains cached pointers to filesystem metadata buffers for performance reasons, but these buffers can be forcibly discarded by nilfs_clear_dirty_page() during critical situations (such as transitioning to read-only mode after metadata corruption). When the driver later attempts to reuse these cached buffer pointers without validating them, mark_buffer_dirty() is called on invalid buffers, triggering kernel warnings and potential panics if panic_on_warn is enabled. The vulnerability can be triggered via a corrupted disk image. The fix checks the buffer_uptodate flag before reusing cached buffers and reloads metadata if the flag is lost, preventing use of stale buffers.
Affected products
- Linux Linux Kernel 3.10 and later (as of patch date; potentially earlier versions affected)
Timeline
- 2023-08-18: disclosed
- 2023-09-06: patched: Patch committed to stable kernel trees