CVE-2024-53690

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nilfs2: prevent use of deleted inode

syzbot reported a WARNING in nilfs_rmdir. [1]

Because the inode bitmap is corrupted, an inode with an inode number that

should exist as a ".nilfs" file was reassigned by nilfs_mkdir for "file0",

causing an inode duplication during execution. And this causes an

underflow of i_nlink in rmdir operations.

The inode is used twice by the same task to unmount and remove directories

".nilfs" and "file0", it trigger warning in nilfs_rmdir.

Avoid to this issue, check i_nlink in nilfs_iget(), if it is 0, it means

that this inode has been deleted, and iput is executed to reclaim it.

[1]

WARNING: CPU: 1 PID: 5824 at fs/inode.c:407 drop_nlink+0xc4/0x110 fs/inode.c:407

...

Call Trace:

<TASK>

nilfs_rmdir+0x1b0/0x250 fs/nilfs2/namei.c:342

vfs_rmdir+0x3a3/0x510 fs/namei.c:4394

do_rmdir+0x3b5/0x580 fs/namei.c:4453

__do_sys_rmdir fs/namei.c:4472 [inline]

__se_sys_rmdir fs/namei.c:4470 [inl

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References