CVE-2023-52760

What it actually does

Use-after-free in gfs2_qd_dealloc RCU callback when gfs2_sbd is freed before quota cleanup completes in gfs2_put_super if gfs2_quota_cleanup was not invoked.

Why it matters to the business

Local attackers can crash systems or execute arbitrary code with kernel privileges on unpatched Linux kernels using GFS2, leading to full host compromise, data loss, or service disruption; high prevalence in Linux environments increases exposure.

How an attack unfolds

An attacker with local access triggers GFS2 filesystem unmount or shutdown paths that skip quota cleanup, allowing the freed gfs2_sbd to be dereferenced in a later RCU callback for gfs2_quota_data objects.

How to fix it

Upgrade to fixed kernel versions including Linux 6.6.3 or commits 08a28272faa750d4357ea2cb48d2baefd778ea81 and 7753af06eebfb56b44673bbfcb0b78d73a54ede9; apply vendor patches immediately given 878 days since publication.

How to confirm the fix worked

Confirm kernel version is at or above fixed releases; review gfs2_put_super and gfs2_quota_cleanup call paths in source; test unmount/shutdown sequences under GFS2 workload.

Typical attack path

1. Obtain local user access on target Linux system
2. Mount or interact with GFS2 filesystem to allocate quota data structures
3. Trigger unmount or shutdown sequence that bypasses gfs2_quota_cleanup
4. Force RCU callback execution to dereference already-freed gfs2_sbd memory
5. Leverage resulting use-after-free for kernel memory corruption or code execution

How to detect it

Review kernel logs for GFS2 quota-related slab or RCU errors during unmount; inspect for unexpected crashes or memory corruption indicators in dmesg around GFS2 shutdown events.

What your security team should do

• Prioritize patching all GFS2-enabled systems to fixed kernel versions
• Monitor for local privilege escalation attempts on unpatched hosts
• Restrict local user access and GFS2 usage where possible until updated
• Incorporate kernel update into standard hardening and deployment processes