CVE-2023-2985

What it actually does

Use-after-free in hfsplus_put_super during HFS+ superblock cleanup allows a local process to trigger kernel memory corruption resulting in denial of service.

Why it matters to the business

A local user can crash affected Linux systems that mount HFS+ volumes, causing unplanned downtime and potential data loss on servers or workstations using the filesystem.

How an attack unfolds

An attacker with local shell access repeatedly mounts and unmounts specially crafted HFS+ images to trigger the use-after-free during superblock release, leading to kernel panic.

How to fix it

Upgrade the Linux kernel to a version containing commit 07db5e247ab5858439b14dd7cc1fe538b9efcf32 or later; disable HFS+ support if the filesystem is not required.

How to confirm the fix worked

Verify the running kernel contains commit 07db5e247ab5858439b14dd7cc1fe538b9efcf32; attempt to mount/unmount HFS+ volumes while monitoring for use-after-free warnings in dmesg.

Typical attack path

1. Obtain local user access on a Linux system
2. Prepare or obtain an HFS+ filesystem image that exercises the put_super path
3. Mount and unmount the image in rapid succession
4. Trigger kernel oops or panic via the dangling reference

How to detect it

Review kernel logs (dmesg, /var/log/kern.log) for use-after-free or general protection fault messages referencing hfsplus_put_super or fs/hfsplus/super.c around the time of unexpected reboots.

• hfsplus_put_super
• fs/hfsplus/super.c
• use-after-free
• general protection fault

What your security team should do

• Apply the referenced kernel commit or newer distribution kernel package immediately on systems exposing HFS+ volumes
• Restrict local user access to untrusted HFS+ images via mount options or SELinux/AppArmor policies
• Monitor kernel logs for hfsplus-related oops entries