CVE-2023-52600: Fixing Use-After-Free Vulnerability in JFS Evict Inode on Linux Kernel

Summary: A use-after-free vulnerability has been discovered and resolved in the Linux kernel, specifically within the JFS (Journaled File System) evict_inode function. The vulnerability could have allowed an attacker to access freed objects and potentially cause data corruption and kernel crashes. In this exclusive long read post, we will dissect the resolved issue and discuss the details including code snippets, links to the original references, and exploits.

Background: The Linux kernel is the central component of a Linux operating system and is responsible for managing system resources, providing essential services to the user space, and enforcing security policies. The Journaled File System (JFS) is a high-performance, reliable, and scalable file system for Linux that can handle large disk arrays, support efficient journaling, and provide fast recovery after system crashes. The evict_inode function in the JFS is responsible for freeing or cleaning up an inode, which is a data structure that represents a file or directory in the file system.

The Vulnerability

In the Linux kernel, within the JFS implementation, a use-after-free vulnerability was identified in the jfs_evict_inode function. Specifically, the issue occurs when diMount(ipimap) execution fails, leading to the release of the ipimap object, which may then be accessed in diFreeSpecial(). Asynchronous ipimap release occurs when rcu_core() calls jfs_free_node().

Here is the original code snippet illustrating the problem

static void jfs_evict_inode(struct inode *inode)
{
(...)
	if (is_bad_inode(inode)) {
		iput(inode->i_mapping->host);
		goto out;
	}
	sb = inode->i_sb;
	sbi = JFS_SBI(sb);
    // The ipimap object is released
	diFreeSpecial(inode, sbi->iping);
(...)
	diFreeSpecial(inode, sbi->ipimap);
}

The Fix

To resolve this vulnerability, developers have ensured that when diMount(ipimap) fails, sbi->ipimap should not be initialized as ipimap. This prevents the use-after-free issue by ensuring that the released ipimap object is not accessed afterward. Below is the corrected code snippet:

static void jfs_evict_inode(struct inode *inode)
{
(...)
	if (is_bad_inode(inode)) {
		iput(inode->i_mapping->host);
		goto out;
	}
	sb = inode->i_sb;
	sbi = JFS_SBI(sb);
	if (unlikely(inode == sbi->ipimap))
		goto out_bad;
	diFreeSpecial(inode, sbi->iping);
(...)
	diFreeSpecial(inode, sbi->ipimap);
out_bad:
	return;
}

Exploit Details

It is conceivable that a remote attacker could exploit this use-after-free vulnerability to cause data corruption, crash the kernel, or potentially gain unauthorized access to kernel data structures, leading to a compromise of the underlying system. However, successful exploitation would likely require intricate knowledge of the kernel internals and the ability to trigger specific conditions for the vulnerability to manifest.

Original References

The vulnerability was initially discovered and analyzed by the Linux kernel developers, and a patch was subsequently provided to resolve the issue. The patch can be found at the following link:

Link to the Original Patch

Conclusion

CVE-2023-52600 marks a crucial use-after-free vulnerability discovered and resolved in the Linux kernel, involving the JFS evict_inode function. By addressing this issue, the Linux kernel can continue to provide a secure and stable environment to countless systems around the world. Users and developers are encouraged to apply the patch and update to the latest Linux kernel version to maintain security. As always, it is essential to keep an eye on security updates and ensure that systems are up-to-date to protect against potential vulnerabilities.

Timeline

Published on: 03/06/2024 07:15:10 UTC
Last modified on: 06/27/2024 12:15:15 UTC