Executive Summary

This vulnerability exists in the Linux kernel's filesystem cache management. Specifically, when the mb_cache_destroy() function is called, it frees the cache memory but does not cancel a pending work item called c_shrink_work. If this work item is still scheduled or running, it can access the cache after it has been freed, leading to a use-after-free condition.

This situation can only be triggered by a privileged user (root or with CAP_SYS_ADMIN capability) who can cause the last release of a mounted ext2, ext4, or ocfs2 filesystem. The fix involves cancelling the pending work item before freeing the cache to ensure no access occurs after memory is freed.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to a use-after-free scenario in the Linux kernel, which may cause system instability, crashes, or potentially allow an attacker with privileged access to execute arbitrary code or escalate privileges.

However, exploitation requires privileged access (root or CAP_SYS_ADMIN), so it does not directly affect unprivileged users but poses a risk if an attacker gains such privileges.

Useful 0 Not Useful 0

Mitigation Strategies

This vulnerability can be mitigated by ensuring that the work item c_shrink_work is cancelled before the cache is destroyed.

Specifically, the fix involves calling cancel_work_sync() on the pending work item before calling shrinker_free(), which ensures the worker has finished and will not be rescheduled before the cache is torn down.

Additionally, only privileged users (root or CAP_SYS_ADMIN) can trigger this vulnerability, so limiting privileged access can reduce risk.

Useful 0 Not Useful 0