CVE-2023-3212

What it actually does

NULL pointer dereference in gfs2 evict code that references a freed journal descriptor structure on corrupt filesystems, resulting in kernel panic.

Why it matters to the business

Privileged local users can crash affected Linux systems using the gfs2 filesystem, causing unplanned downtime and service interruption; high privileges required limits blast radius but still poses operational risk on multi-tenant or shared systems.

How an attack unfolds

An attacker with administrative privileges prepares or mounts a corrupt gfs2 filesystem, triggers inode eviction (for example via unmount or file removal), and the kernel dereferences the now-NULL journal descriptor, forcing a panic.

How to fix it

Upgrade the Linux kernel to a version containing commit 6995e2de6891c724bfeb2db33d7b87775f913ad1 or later; rebuild and reboot with the fixed kernel; avoid mounting untrusted gfs2 images until patched.

How to confirm the fix worked

Confirm the running kernel contains commit 6995e2de6891c724bfeb2db33d7b87775f913ad1 via git log or kernel version string; attempt to reproduce the panic on a test system with a crafted corrupt gfs2 image before and after the update.

Typical attack path

1. Obtain root or equivalent local privileges on the target system
2. Create or obtain a corrupt gfs2 filesystem image
3. Mount the image or perform operations that cause inode eviction
4. Trigger the evict path that dereferences the freed journal descriptor
5. Kernel panics, resulting in denial of service

How to detect it

Inspect kernel panic logs and dmesg output for gfs2 journal descriptor NULL dereference messages; correlate with recent privileged local activity on systems hosting gfs2 volumes.

What your security team should do

• Apply the fixed kernel commit immediately on all systems using gfs2
• Restrict gfs2 filesystem usage to trusted images only until patches are deployed
• Monitor kernel crash logs for gfs2-related panics as an interim detection measure
• Review systems for unnecessary gfs2 mounts and remove where possible