CVE-2023-54140

What it actually does

Use-after-free condition in nilfs2 where internally cached buffer pointers become invalid after nilfs_clear_dirty_page discards them, allowing mark_buffer_dirty to operate on stale metadata buffers and trigger warnings or panics.

Why it matters to the business

Systems relying on the nilfs2 filesystem may experience unexpected kernel instability or crashes during metadata operations, particularly when handling corrupted images; the niche nature of nilfs2 limits widespread operational disruption.

How an attack unfolds

An attacker supplies a specially crafted corrupted nilfs2 disk image, mounts it, and performs repeated metadata allocation or inode operations that cause the kernel to reuse a buffer whose uptodate flag has been cleared, leading to the warning path.

How to fix it

Upgrade the Linux kernel package to version 5.10.178-1 or later; rebuild and reboot with the updated kernel; avoid mounting untrusted nilfs2 images until patched.

How to confirm the fix worked

Confirm the running kernel is at or above 5.10.178-1, reproduce the original syzbot reproducer with a corrupted image, and verify absence of the mark_buffer_dirty warning and panic_on_warn behavior.

Typical attack path

1. Provide or induce a corrupted nilfs2 filesystem image
2. Mount the image on a vulnerable kernel
3. Trigger repeated palloc or inode dirty operations via stress or crafted workload
4. Cause nilfs_clear_dirty_page to discard a still-referenced buffer
5. Invoke mark_buffer_dirty on the stale buffer pointer

How to detect it

Search kernel logs for WARNING messages originating from mark_buffer_dirty called via __nilfs_mark_inode_dirty or nilfs_palloc_commit_alloc_entry, especially on systems mounting nilfs2 volumes.

• mark_buffer_dirty
• __nilfs_mark_inode_dirty
• nilfs_palloc_commit_alloc_entry
• nilfs_clear_dirty_page

What your security team should do

• Identify any systems using the nilfs2 filesystem and schedule kernel updates immediately
• Block mounting of untrusted or external nilfs2 volumes as a temporary control
• Monitor kernel logs for nilfs2 buffer-related warnings until patches are applied