CVE-2023-52591

What it actually does

Race condition in reiserfs rename handling allows modification of a directory inode without VFS locking when its parent directory is unchanged, enabling concurrent operations to corrupt on-disk structures.

Why it matters to the business

Filesystem corruption on Linux systems using reiserfs can lead to data loss, application failures, and unplanned downtime requiring recovery from backups or filesystem repair.

How an attack unfolds

An attacker with local access performs concurrent rename operations on directories within a reiserfs filesystem, exploiting the missing lock to trigger inconsistent metadata updates that corrupt the filesystem.

How to fix it

Update the Linux kernel to a version containing commit 17e1361cb91dc1325834da95d2ab532959d2debc or later stable release that addresses the reiserfs rename locking issue.

How to confirm the fix worked

Verify the running kernel contains the fix commit or is newer than the vulnerable versions; test rename operations under load on reiserfs to confirm absence of corruption.

Typical attack path

1. Obtain local unprivileged access to a system mounting a reiserfs filesystem
2. Identify or create directories suitable for rename operations
3. Execute concurrent rename syscalls that keep the parent directory unchanged
4. Trigger the race to cause on-disk metadata inconsistency and corruption

How to detect it

Review kernel logs for reiserfs corruption warnings or errors during rename operations; examine audit logs for unusual patterns of directory renames on reiserfs mounts.

What your security team should do

• Prioritize kernel upgrade on all systems using reiserfs
• Migrate critical workloads away from reiserfs to supported filesystems such as ext4 or xfs
• Monitor for filesystem errors after applying updates