CVE-2023-53311

What it actually does

Use-after-free read of the nilfs_root structure during inode dirtying via iput() and mark_inode_dirty_sync() after the log writer is detached in nilfs_detach_log_writer(), specifically in the path through nilfs_dispose_list() when I_DIRTY_TIME is set.

Why it matters to the business

Systems using the nilfs2 filesystem may experience kernel crashes, memory corruption, or potential local privilege escalation during filesystem unmount operations, increasing downtime and risk on affected Linux deployments.

How an attack unfolds

An attacker with local access crafts or mounts a nilfs2 filesystem containing inodes with the I_DIRTY_TIME flag, triggers unmount to detach the log writer and dispose the garbage list, then causes iput() to invoke mark_inode_dirty_sync() which dereferences the freed nilfs_root via __nilfs_mark_inode_dirty() and nilfs_load_inode_block().

How to fix it

Upgrade to fixed kernel versions containing commit 11afd67f1b3c28eb216e50a3ca8dbcb69bb71793 or apply the purging flag patch in __nilfs_mark_inode_dirty() and nilfs structure; for Debian systems update perl packages to 5.10.0-18 or later equivalents containing the kernel fix.

How to confirm the fix worked

Verify kernel source contains the purging flag logic in nilfs_detach_log_writer() and __nilfs_mark_inode_dirty(); test by reproducing the syzbot conditions on unmount with dirty inodes and confirm no UAF occurs; check dmesg and slab debug for use-after-free reports.

Typical attack path

1. Mount a nilfs2 filesystem and create files with dirty time state
2. Trigger unmount to enter nilfs_detach_log_writer() and dispose_list()
3. Invoke iput() on remaining inodes with I_DIRTY_TIME set
4. Execute mark_inode_dirty_sync() leading to UAF read in nilfs_load_inode_block()

How to detect it

Review kernel logs for nilfs2 unmount traces combined with slab UAF warnings referencing nilfs_root; inspect audit logs for unusual mount/umount sequences on nilfs2 volumes; correlate with process activity invoking iput or mark_inode_dirty_sync near filesystem detach events.

What your security team should do

• Prioritize kernel upgrades on all systems using nilfs2 to the listed fixed commits or package versions
• Restrict unprivileged mounting of nilfs2 filesystems until patched
• Enable kernel hardening features such as KASAN or slab freelist randomization for detection
• Monitor for unmount operations on nilfs2 volumes in production environments