CVE-2024-35815

What it actually does

The vulnerability allows an out-of-order read of req->ki_ctx before verifying the IOCB_AIO_RW flag, potentially causing the kernel to treat a non-aio_kiocb struct as an aio_kiocb during NFS AIO cancellation handling and resulting in invalid memory access or corruption.

Why it matters to the business

Local users on affected older Ubuntu systems can trigger kernel instability or denial of service, disrupting workloads that rely on NFS with asynchronous I/O; urgency remains low given the absence from known exploitation lists and very low exploit probability.

How an attack unfolds

An attacker with local access submits NFS AIO operations that exercise kiocb_set_cancel_fn with a non-embedded kiocb, relying on compiler-dependent ordering so that the ki_ctx field is read before the type check; this can lead to invalid pointer dereference or memory corruption in the aio context.

How to fix it

Upgrade to the fixed package versions listed for each affected Ubuntu release (for example linux 3.11.0-12.19 on 14.04, 4.4.0-2.16 on 16.04, 4.13.0-16.19 on 18.04, and 5.4.0-9.12 on 20.04) and reboot.

How to confirm the fix worked

Confirm the running kernel package version matches or exceeds the listed fixed versions for the distribution release; test that NFS AIO workloads no longer produce crashes under the previous triggering conditions.

Typical attack path

1. Obtain local user access on an affected Ubuntu kernel
2. Mount an NFS filesystem and issue AIO read/write requests that invoke cancellation paths
3. Trigger the window where req->ki_ctx is accessed without the IOCB_AIO_RW guard
4. Cause kernel memory corruption or crash

How to detect it

Review kernel logs for oops or panic messages involving aio_kiocb, kiocb_set_cancel_fn, or NFS AIO paths; examine audit logs for unusual AIO activity on NFS mounts around the time of any crash.

What your security team should do

• Prioritize patching any remaining systems still running the vulnerable Ubuntu kernel packages
• Monitor for kernel oops or panic logs related to aio_kiocb or NFS AIO cancellation
• Limit local user access on systems that cannot be immediately updated