CVE-2023-52779

What it actually does

NULL pointer dereference in kernel getattr path when vfs_getattr_nosec() is called on overlayfs or ecryptfs; the missing GETATTR_NOSEC flag causes fallback to vfs_getattr() which invokes security_inode_getattr() on an exiting process lacking current->fs.

Why it matters to the business

Kernel panic or denial of service on Linux systems using overlayfs or ecryptfs together with IMA or similar LSMs; operational disruption and potential data loss on affected hosts until patched kernels are deployed.

How an attack unfolds

An attacker with local access or the ability to influence file operations on an overlayfs mount triggers vfs_getattr_nosec during a process exit window; the absent flag leads to the security check on a NULL fs context, crashing the kernel.

How to fix it

Apply the upstream fix in commit 3fb0fa08641903304b9d81d52a379ff031dc41d4 or later stable kernels that propagate the GETATTR_NOSEC flag and avoid the security call in overlayfs/ecryptfs getattr handlers.

How to confirm the fix worked

Confirm kernel source contains the GETATTR_NOSEC flag handling and the overlayfs/ecryptfs getattr logic checks the flag before choosing vfs_getattr versus vfs_getattr_nosec; test attribute operations under IMA on patched builds.

Typical attack path

1. Gain local execution or file-system interaction on target
2. Perform file attribute lookup that reaches vfs_getattr_nosec on overlayfs
3. Time the operation with process exit to hit the missing current->fs condition
4. Trigger kernel NULL dereference and system instability

How to detect it

Review kernel logs and crash dumps for NULL pointer dereference during getattr or security_inode_getattr calls involving overlayfs; correlate with process exit events and IMA-enabled systems.

What your security team should do

• Prioritize kernel upgrades containing commit 3fb0fa08641903304b9d81d52a379ff031dc41d4 on all systems using overlayfs or ecryptfs
• Audit workloads for overlayfs/ecryptfs + IMA combinations and schedule reboots after patching
• Monitor kernel logs for NULL pointer dereference signatures in getattr paths until patches are applied