Executive brief
A race condition in the Linux kernel's disk quota system could allow a local user to crash the system. The quota system manages how much disk space users or groups can consume; an exploit of this flaw results in a 'NULL pointer dereference,' leading to a kernel panic and system unavailability. This affects the reliability and uptime of servers, particularly in multi-user environments.
Technical details
A race condition exists in fs/quota/dquot.c within the Linux kernel. The vulnerability is triggered when one process (e.g., dquot_free_inode) checks an inode's quota pointers while another process (e.g., quota_off) concurrently sets those pointers to NULL. If the first process validates the pointer as non-NULL but the second process clears it before the first process attempts to use it (such as during a spin_lock operation), a NULL pointer dereference occurs. This is a classic TOCTOU (Time-of-Check to Time-of-Use) bug. The fix involves using temporary pointers and proper SRCU dereferencing to ensure pointer stability during the operation. Patches have been released across multiple stable kernel branches.
Affected products
- Linux Linux Kernel versions up to 4.19.311, 4.20 to 5.4.273, 5.5 to 5.10.214, 5.11 to 5.15.153, 5.16 to 6.1.83, 6.2 to 6.6.23, 6.7 to 6.7.11, 6.8 to 6.8.2
Timeline
- 2024-02-02: other: Patch submitted by developer
- 2024-04-17: disclosed: CVE published
References
- https://git.kernel.org/stable/c/1ca72a3de915f87232c9a4cb9bebbd3af8ed3e25
- https://git.kernel.org/stable/c/40a673b4b07efd6f74ff3ab60f38b26aa91ee5d5
- https://git.kernel.org/stable/c/49669f8e7eb053f91d239df7b1bfb4500255a9d0
- https://git.kernel.org/stable/c/61380537aa6dd32d8a723d98b8f1bd1b11d8fee0
- https://git.kernel.org/stable/c/6afc9f4434fa8063aa768c2bf5bf98583aee0877
- https://git.kernel.org/stable/c/7f9e833fc0f9b47be503af012eb5903086939754
- https://git.kernel.org/stable/c/8514899c1a4edf802f03c408db901063aa3f05a1