CVE-2024-53173

What it actually does

Use-after-free of an rpc_task pointer in nfs4_opendata_free() via nfs_release_seqid() when concurrent NFSv4.0 open() operations from multiple threads abort before nfs_wait_on_sequence() completes.

Why it matters to the business

Kernel instability or crashes on systems performing NFSv4.0 file operations under concurrent access, with potential for local privilege escalation or denial of service in shared storage environments.

How an attack unfolds

An attacker with local access triggers two threads to issue simultaneous NFSv4.0 open calls that are aborted before replies arrive; the resulting race in sequence ID release frees an rpc_task still referenced by the other thread, enabling use-after-free for memory corruption.

How to fix it

Update the Linux kernel to a version containing the fix that moves nfs_release_seqid() into nfs4_open_release() for aborted calls; apply the corrected package versions for affected distributions.

How to confirm the fix worked

Confirm the kernel source contains the nfs4_open_release() call to nfs_release_seqid() prior to rpc_task free, and verify no use-after-free occurs under concurrent open/abort test workloads.

Typical attack path

1. Obtain local execution on a system using NFSv4.0 mounts
2. Spawn concurrent threads performing file open operations
3. Force early abort of RPC calls before sequence wait completes
4. Trigger nfs4_opendata_free path that releases the shared seqid
5. Exploit the dangling rpc_task pointer for memory corruption or control flow hijack

How to detect it

Review kernel logs for NFSv4 sequence ID handling errors or oops reports during concurrent open operations; examine audit logs for unusual patterns of file open calls from multiple threads on NFS mounts.

What your security team should do

• Prioritize kernel updates on all NFSv4.0 clients due to local exploit potential
• Monitor for new kernel releases addressing this use-after-free
• Restrict untrusted local code execution on NFS client systems until patched
• Test concurrent open workloads after patching to validate stability