CVE-2024-53690

What it actually does

Corrupted inode bitmap in nilfs2 allows reassignment of inode numbers, causing inode duplication and i_nlink underflow when the same inode is used for multiple directories, leading to use of a deleted inode.

Why it matters to the business

Systems using the nilfs2 filesystem may experience kernel warnings or instability during directory operations, potentially impacting availability and requiring filesystem recovery in affected Linux environments.

How an attack unfolds

An attacker corrupts the inode bitmap to force inode number reuse between .nilfs and another directory, then triggers rmdir operations that dereference the deleted inode, resulting in the observed warning and potential further exploitation of the use-after-free condition.

How to fix it

Update the Linux kernel to include commit 55e4baa0d32f0530ddc64c26620e1f2f8fa2724c which adds an i_nlink check in nilfs_iget() to reclaim deleted inodes before use.

How to confirm the fix worked

Confirm the running kernel contains commit 55e4baa0d32f0530ddc64c26620e1f2f8fa2724c, then exercise nilfs2 mkdir and rmdir operations while monitoring for drop_nlink warnings.

Typical attack path

1. Corrupt the nilfs2 inode bitmap
2. Trigger mkdir to reassign the inode number
3. Execute rmdir on both affected directories
4. Induce i_nlink underflow and use of the deleted inode

How to detect it

Search kernel logs for WARNING messages from drop_nlink in fs/inode.c triggered by nilfs_rmdir calls, particularly on systems mounting nilfs2 volumes.

What your security team should do

• Apply the referenced kernel commit or newer stable release containing the fix
• Audit systems for nilfs2 usage and consider migration if the filesystem is non-essential
• Enable kernel logging and monitoring for inode-related warnings