CVE-2024-53155

What it actually does

Uninitialized 'private' field in struct kiocb passed from io_uring to ocfs2_file_read_iter() and ocfs2_file_write_iter() causes use of uninitialized value inside ocfs2_dio_end_io().

Why it matters to the business

Systems using the ocfs2 filesystem with io_uring may experience kernel crashes or unpredictable behavior during file reads and writes, disrupting storage-dependent workloads.

How an attack unfolds

An attacker submits specially crafted io_uring requests targeting ocfs2-mounted files; the kernel allocates a kiocb with an uninitialized private field that ocfs2 later dereferences, resulting in undefined behavior that can be leveraged for denial of service or information disclosure.

How to fix it

Upgrade the Linux kernel to a version containing commit 6c8f8d1e595dabd5389817f6d798cc8bd95c40ab or later; apply the same fix to any downstream distribution kernels that include ocfs2.

How to confirm the fix worked

Confirm the presence of the ocfs2_iocb_init_rw_locked() helper and absence of the KMSAN splat in ocfs2_file_read_iter() after applying the patch; verify with kernel version checks and targeted io_uring test workloads on ocfs2.

Typical attack path

1. Mount an ocfs2 filesystem
2. Issue io_uring SQEs for read or write operations on ocfs2 files
3. Trigger allocation paths that leave kiocb.private uninitialized
4. Invoke ocfs2_dio_end_io() which consumes the uninitialized value

How to detect it

Search kernel logs and KMSAN reports for the stack trace containing ocfs2_file_read_iter+0x9a4 and __io_alloc_req_refill; inspect io_uring submission paths on ocfs2 mounts for crashes involving uninitialized slab memory.

• ocfs2_file_read_iter+0x9a4/0xf80
• BUG: KMSAN: uninit-value in ocfs2_file_read_iter
• ocfs2_dio_end_io

What your security team should do

• Prioritize kernel updates on all systems using ocfs2 and io_uring
• Disable io_uring or ocfs2 where not required until patches are applied
• Monitor for kernel oops or KMSAN reports referencing ocfs2_file_read_iter