CVE-2024-56558

What it actually does

Use-after-free in nfsd e_show path: RCU protects only against free of the export structure, allowing its refcount to reach zero; subsequent exp_get triggers refcount_t addition-on-zero warning and potential UAF.

Why it matters to the business

NFS servers on affected kernels may experience warnings, crashes, or memory corruption during export listing or monitoring operations, risking service disruption on file-sharing workloads.

How an attack unfolds

An attacker with local access or the ability to trigger NFS export enumeration (via cat on the exports cache or similar seq_file reads) races the RCU-protected read with an export teardown so that the refcount hits zero; cache_get_rcu is missing, leading to the refcount warning and possible follow-on memory corruption.

How to fix it

Apply the upstream fix commit e2fa0d0e327279a8defb87b263cd0bf288fd9261 or later; rebuild and reboot to a patched kernel. For distribution kernels, install the vendor update that backports cache_get_rcu usage in nfsd/export.c.

How to confirm the fix worked

Confirm kernel source contains the cache_get_rcu call in svc_export_show / e_show; verify no refcount warnings appear in dmesg during export enumeration after upgrade; check running kernel version against the fixed commit or package changelog.

Typical attack path

1. Obtain local shell or trigger privileged NFS export view operation
2. Cause concurrent export invalidation or unexport while seq_read on exports cache is in progress
3. Trigger e_show under RCU which calls exp_get on a now-zero refcount object
4. Observe refcount warning or escalate via resulting UAF memory corruption

How to detect it

Search kernel logs (dmesg, /var/log/kern.log, journalctl) for the exact refcount warning and the call trace containing e_show+0x20b and nfsd; correlate with processes reading exports seq_file or running cat on NFS-related proc files around the same timestamp.

• refcount_t: addition on 0; use-after-free
• refcount_warn_saturate+0xb1/0x120
• e_show+0x20b/0x230 [nfsd]
• WARNING: CPU:.*PID:.*at lib/refcount.c:25

What your security team should do

• Prioritize kernel updates on all systems exposing NFS (highest urgency for multi-user or internet-adjacent servers)
• Monitor dmesg and kernel logs for the refcount warning string until patches are deployed
• Restrict unprivileged access to /proc/fs/nfsd or exports cache files where feasible
• Test patched kernels in staging before broad rollout given the refcount change