CVE-2024-53690

MEDIUM

Linux Kernel - Use-After-Free in nilfs_rmdir via Inode Reuse

Title source: llm
STIX 2.1

Description

In the Linux kernel, the following vulnerability has been resolved: nilfs2: prevent use of deleted inode syzbot reported a WARNING in nilfs_rmdir. [1] Because the inode bitmap is corrupted, an inode with an inode number that should exist as a ".nilfs" file was reassigned by nilfs_mkdir for "file0", causing an inode duplication during execution. And this causes an underflow of i_nlink in rmdir operations. The inode is used twice by the same task to unmount and remove directories ".nilfs" and "file0", it trigger warning in nilfs_rmdir. Avoid to this issue, check i_nlink in nilfs_iget(), if it is 0, it means that this inode has been deleted, and iput is executed to reclaim it. [1] WARNING: CPU: 1 PID: 5824 at fs/inode.c:407 drop_nlink+0xc4/0x110 fs/inode.c:407 ... Call Trace: <TASK> nilfs_rmdir+0x1b0/0x250 fs/nilfs2/namei.c:342 vfs_rmdir+0x3a3/0x510 fs/namei.c:4394 do_rmdir+0x3b5/0x580 fs/namei.c:4453 __do_sys_rmdir fs/namei.c:4472 [inline] __se_sys_rmdir fs/namei.c:4470 [inline] __x64_sys_rmdir+0x47/0x50 fs/namei.c:4470 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Scores

CVSS v3 5.5
EPSS 0.0025
EPSS Percentile 16.9%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Details

Status published
Products (24)
linux/Kernel 2.6.30 - 5.4.289linux
linux/Kernel 5.11.0 - 5.15.176linux
linux/Kernel 5.16.0 - 6.1.122linux
linux/Kernel 5.5.0 - 5.10.233linux
linux/Kernel 6.2.0 - 6.6.68linux
linux/Kernel 6.7.0 - 6.12.7linux
Linux/Linux < 2.6.30
Linux/Linux 2.6.30
Linux/Linux 5.10.233 - 5.10.*
Linux/Linux 5.15.176 - 5.15.*
... and 14 more
Published Jan 11, 2025
Tracked Since Feb 18, 2026