CVE-2024-53174

What it actually does

The flaw permits a refcount increment on a cache entry whose reference count has already reached zero under RCU protection in c_show, resulting in a use-after-free condition.

Why it matters to the business

Systems may experience kernel warnings, instability, or crashes during routine access to RPC cache statistics, increasing operational risk for services relying on network file and authentication protocols.

How an attack unfolds

An attacker with local access triggers repeated reads of /proc/net/rpc entries while cache entries are concurrently invalidated, causing the reference count to hit zero before cache_get is invoked and producing the refcount warning.

How to fix it

Update the Linux kernel to a version containing the fix that replaces cache_get with cache_get_rcu in c_show; apply the vendor-supplied package update for the affected distribution.

How to confirm the fix worked

Confirm the kernel source contains the cache_get_rcu call in c_show and that the refcount warning no longer appears during cache reads after the update; verify the running kernel version matches the fixed release.

Typical attack path

1. Obtain local shell or code execution on the target host
2. Open or read files under /proc/net/rpc to invoke c_show
3. Concurrently trigger cache entry invalidation or RCU grace period expiry
4. Observe or trigger the refcount use-after-free warning and potential crash

How to detect it

Search kernel logs for the exact refcount_t addition on 0 warning and the call trace containing c_show and sunrpc; review audit logs for unusual reads of proc net rpc files around the time of the warning.

• refcount_t: addition on 0; use-after-free
• WARNING: CPU:.*PID:.*at lib/refcount.c
• c_show+0x2fc/0x380 [sunrpc]

What your security team should do

• Prioritize kernel updates on all systems exposing RPC or NFS services
• Monitor for refcount warnings in system logs and schedule reboots after patching
• Restrict unprivileged access to /proc/net/rpc where feasible until patches are applied