GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-53216 (GCVE-0-2024-53216)

Vulnerability from cvelistv5 – Published: 2024-12-27 13:50 – Updated: 2026-08-05 11:44
VLAI
Title
nfsd: release svc_expkey/svc_export with rcu_work
Summary
In the Linux kernel, the following vulnerability has been resolved: nfsd: release svc_expkey/svc_export with rcu_work The last reference for `cache_head` can be reduced to zero in `c_show` and `e_show`(using `rcu_read_lock` and `rcu_read_unlock`). Consequently, `svc_export_put` and `expkey_put` will be invoked, leading to two issues: 1. The `svc_export_put` will directly free ex_uuid. However, `e_show`/`c_show` will access `ex_uuid` after `cache_put`, which can trigger a use-after-free issue, shown below. ================================================================== BUG: KASAN: slab-use-after-free in svc_export_show+0x362/0x430 [nfsd] Read of size 1 at addr ff11000010fdc120 by task cat/870 CPU: 1 UID: 0 PID: 870 Comm: cat Not tainted 6.12.0-rc3+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x53/0x70 print_address_description.constprop.0+0x2c/0x3a0 print_report+0xb9/0x280 kasan_report+0xae/0xe0 svc_export_show+0x362/0x430 [nfsd] c_show+0x161/0x390 [sunrpc] seq_read_iter+0x589/0x770 seq_read+0x1e5/0x270 proc_reg_read+0xe1/0x140 vfs_read+0x125/0x530 ksys_read+0xc1/0x160 do_syscall_64+0x5f/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e Allocated by task 830: kasan_save_stack+0x20/0x40 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x8f/0xa0 __kmalloc_node_track_caller_noprof+0x1bc/0x400 kmemdup_noprof+0x22/0x50 svc_export_parse+0x8a9/0xb80 [nfsd] cache_do_downcall+0x71/0xa0 [sunrpc] cache_write_procfs+0x8e/0xd0 [sunrpc] proc_reg_write+0xe1/0x140 vfs_write+0x1a5/0x6d0 ksys_write+0xc1/0x160 do_syscall_64+0x5f/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e Freed by task 868: kasan_save_stack+0x20/0x40 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 __kasan_slab_free+0x37/0x50 kfree+0xf3/0x3e0 svc_export_put+0x87/0xb0 [nfsd] cache_purge+0x17f/0x1f0 [sunrpc] nfsd_destroy_serv+0x226/0x2d0 [nfsd] nfsd_svc+0x125/0x1e0 [nfsd] write_threads+0x16a/0x2a0 [nfsd] nfsctl_transaction_write+0x74/0xa0 [nfsd] vfs_write+0x1a5/0x6d0 ksys_write+0xc1/0x160 do_syscall_64+0x5f/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e 2. We cannot sleep while using `rcu_read_lock`/`rcu_read_unlock`. However, `svc_export_put`/`expkey_put` will call path_put, which subsequently triggers a sleeping operation due to the following `dput`. ============================= WARNING: suspicious RCU usage 5.10.0-dirty #141 Not tainted ----------------------------- ... Call Trace: dump_stack+0x9a/0xd0 ___might_sleep+0x231/0x240 dput+0x39/0x600 path_put+0x1b/0x30 svc_export_put+0x17/0x80 e_show+0x1c9/0x200 seq_read_iter+0x63f/0x7c0 seq_read+0x226/0x2d0 vfs_read+0x113/0x2c0 ksys_read+0xc9/0x170 do_syscall_64+0x33/0x40 entry_SYSCALL_64_after_hwframe+0x67/0xd1 Fix these issues by using `rcu_work` to help release `svc_expkey`/`svc_export`. This approach allows for an asynchronous context to invoke `path_put` and also facilitates the freeing of `uuid/exp/key` after an RCU grace period.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-02-11 15:43 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 9ceddd9da13434a5906255c0fc528c385aded283 , < bd8524148dd8c123334b066faa90590ba2ef8e6f (git)
Affected: 9ceddd9da13434a5906255c0fc528c385aded283 , < 2e4854599200f4d021df8ae17e69221d7c149f3e (git)
Affected: 9ceddd9da13434a5906255c0fc528c385aded283 , < ad4363a24a5746b257c0beb5d8cc68f9b62c173f (git)
Affected: 9ceddd9da13434a5906255c0fc528c385aded283 , < f8c989a0c89a75d30f899a7cabdc14d72522bb8d (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.20
Unaffected: 0 , < 4.20 (semver)
Unaffected: 6.6.64 , ≤ 6.6.* (semver)
Unaffected: 6.11.11 , ≤ 6.11.* (semver)
Unaffected: 6.12.2 , ≤ 6.12.* (semver)
Unaffected: 6.13 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-53216",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-11T15:43:16.959079Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-11T15:45:26.202Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/export.c",
            "fs/nfsd/export.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bd8524148dd8c123334b066faa90590ba2ef8e6f",
              "status": "affected",
              "version": "9ceddd9da13434a5906255c0fc528c385aded283",
              "versionType": "git"
            },
            {
              "lessThan": "2e4854599200f4d021df8ae17e69221d7c149f3e",
              "status": "affected",
              "version": "9ceddd9da13434a5906255c0fc528c385aded283",
              "versionType": "git"
            },
            {
              "lessThan": "ad4363a24a5746b257c0beb5d8cc68f9b62c173f",
              "status": "affected",
              "version": "9ceddd9da13434a5906255c0fc528c385aded283",
              "versionType": "git"
            },
            {
              "lessThan": "f8c989a0c89a75d30f899a7cabdc14d72522bb8d",
              "status": "affected",
              "version": "9ceddd9da13434a5906255c0fc528c385aded283",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/export.c",
            "fs/nfsd/export.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.20"
            },
            {
              "lessThan": "4.20",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.64",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.64",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.11",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.2",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: release svc_expkey/svc_export with rcu_work\n\nThe last reference for `cache_head` can be reduced to zero in `c_show`\nand `e_show`(using `rcu_read_lock` and `rcu_read_unlock`). Consequently,\n`svc_export_put` and `expkey_put` will be invoked, leading to two\nissues:\n\n1. The `svc_export_put` will directly free ex_uuid. However,\n   `e_show`/`c_show` will access `ex_uuid` after `cache_put`, which can\n   trigger a use-after-free issue, shown below.\n\n   ==================================================================\n   BUG: KASAN: slab-use-after-free in svc_export_show+0x362/0x430 [nfsd]\n   Read of size 1 at addr ff11000010fdc120 by task cat/870\n\n   CPU: 1 UID: 0 PID: 870 Comm: cat Not tainted 6.12.0-rc3+ #1\n   Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS\n   1.16.1-2.fc37 04/01/2014\n   Call Trace:\n    \u003cTASK\u003e\n    dump_stack_lvl+0x53/0x70\n    print_address_description.constprop.0+0x2c/0x3a0\n    print_report+0xb9/0x280\n    kasan_report+0xae/0xe0\n    svc_export_show+0x362/0x430 [nfsd]\n    c_show+0x161/0x390 [sunrpc]\n    seq_read_iter+0x589/0x770\n    seq_read+0x1e5/0x270\n    proc_reg_read+0xe1/0x140\n    vfs_read+0x125/0x530\n    ksys_read+0xc1/0x160\n    do_syscall_64+0x5f/0x170\n    entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\n   Allocated by task 830:\n    kasan_save_stack+0x20/0x40\n    kasan_save_track+0x14/0x30\n    __kasan_kmalloc+0x8f/0xa0\n    __kmalloc_node_track_caller_noprof+0x1bc/0x400\n    kmemdup_noprof+0x22/0x50\n    svc_export_parse+0x8a9/0xb80 [nfsd]\n    cache_do_downcall+0x71/0xa0 [sunrpc]\n    cache_write_procfs+0x8e/0xd0 [sunrpc]\n    proc_reg_write+0xe1/0x140\n    vfs_write+0x1a5/0x6d0\n    ksys_write+0xc1/0x160\n    do_syscall_64+0x5f/0x170\n    entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\n   Freed by task 868:\n    kasan_save_stack+0x20/0x40\n    kasan_save_track+0x14/0x30\n    kasan_save_free_info+0x3b/0x60\n    __kasan_slab_free+0x37/0x50\n    kfree+0xf3/0x3e0\n    svc_export_put+0x87/0xb0 [nfsd]\n    cache_purge+0x17f/0x1f0 [sunrpc]\n    nfsd_destroy_serv+0x226/0x2d0 [nfsd]\n    nfsd_svc+0x125/0x1e0 [nfsd]\n    write_threads+0x16a/0x2a0 [nfsd]\n    nfsctl_transaction_write+0x74/0xa0 [nfsd]\n    vfs_write+0x1a5/0x6d0\n    ksys_write+0xc1/0x160\n    do_syscall_64+0x5f/0x170\n    entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\n2. We cannot sleep while using `rcu_read_lock`/`rcu_read_unlock`.\n   However, `svc_export_put`/`expkey_put` will call path_put, which\n   subsequently triggers a sleeping operation due to the following\n   `dput`.\n\n   =============================\n   WARNING: suspicious RCU usage\n   5.10.0-dirty #141 Not tainted\n   -----------------------------\n   ...\n   Call Trace:\n   dump_stack+0x9a/0xd0\n   ___might_sleep+0x231/0x240\n   dput+0x39/0x600\n   path_put+0x1b/0x30\n   svc_export_put+0x17/0x80\n   e_show+0x1c9/0x200\n   seq_read_iter+0x63f/0x7c0\n   seq_read+0x226/0x2d0\n   vfs_read+0x113/0x2c0\n   ksys_read+0xc9/0x170\n   do_syscall_64+0x33/0x40\n   entry_SYSCALL_64_after_hwframe+0x67/0xd1\n\nFix these issues by using `rcu_work` to help release\n`svc_expkey`/`svc_export`. This approach allows for an asynchronous\ncontext to invoke `path_put` and also facilitates the freeing of\n`uuid/exp/key` after an RCU grace period."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Although the affected subsystem is nfsd, the vulnerable use-after-free is only reachable through a local `read(2)` on `/proc/fs/nfs/exports`, `/proc/fs/nfsd/exports` or `/proc/net/rpc/*/content`; a remote NFS client can drive the freeing half of the race but cannot reach `e_show`/`c_show` itself. Exploitation therefore requires local access.\nAC:L - The attacker fully controls the reader side with an unbounded, unrate-limited read loop, and can actively drive the freeing side because `nfsd_set_fh_dentry()` performs the export-cache lookup and refresh upcall before any secure-port or access check, on top of the routine `cache_clean()`/`sunrpc_cache_update()`/flush churn on any live NFS server. Controlling both halves of the race makes it reliably winnable.\nPR:L - `/proc/fs/nfsd/exports` and `/proc/fs/nfsd/export_stats` are registered `S_IRUGO`, and `/proc/fs/nfs/exports` is created with mode 0 which procfs promotes to 0444, so any unprivileged local user can read them. No capability, namespace trick, or group membership is needed.\nUI:N - The attacker simply reads a world-readable procfs file in a loop; no victim action, mount, or administrator involvement is required.\nS:U - The corruption and its consequences are confined to the kernel\u0027s own memory within a single security authority, with no VM, IOMMU, or sandbox boundary crossed.\nC:H - The freed `ex_uuid`, `ex_client-\u003ename`, `ex_path` dentry chain and `ex_fslocs.locations[]` pointer array are read and copied verbatim into the seq_file buffer returned to the unprivileged reader, so heap grooming of the freed slabs yields disclosure of arbitrary kernel memory to userspace.\nI:H - This is a use-after-free on attacker-groomable slab objects, and the reader performs writes into the freed memory \u2014 `percpu_counter_sum_positive()` takes `raw_spin_lock_irqsave` on the kfree\u0027d `ex_stats`, and `dput`/`mntput` decrement refcounts on freed dentries/mounts \u2014 giving corruption primitives suitable for privilege escalation.\nA:H - The bug is a KASAN-confirmed slab use-after-free that oopses, plus a NULL dereference when `fsloc-\u003elocations` is cleared while `locations_count` remains non-zero, and `dput()` sleeping inside an RCU read-side critical section causing scheduling-while-atomic and RCU stalls \u2014 all kernel crashes."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:44:41.267Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/bd8524148dd8c123334b066faa90590ba2ef8e6f"
        },
        {
          "url": "https://git.kernel.org/stable/c/2e4854599200f4d021df8ae17e69221d7c149f3e"
        },
        {
          "url": "https://git.kernel.org/stable/c/ad4363a24a5746b257c0beb5d8cc68f9b62c173f"
        },
        {
          "url": "https://git.kernel.org/stable/c/f8c989a0c89a75d30f899a7cabdc14d72522bb8d"
        }
      ],
      "title": "nfsd: release svc_expkey/svc_export with rcu_work",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-53216",
    "datePublished": "2024-12-27T13:50:01.869Z",
    "dateReserved": "2024-11-19T17:17:25.024Z",
    "dateUpdated": "2026-08-05T11:44:41.267Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-53216",
      "date": "2026-09-16",
      "epss": "0.00222",
      "percentile": "0.12893"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnfsd: release svc_expkey/svc_export with rcu_work\\n\\nThe last reference for `cache_head` can be reduced to zero in `c_show`\\nand `e_show`(using `rcu_read_lock` and `rcu_read_unlock`). Consequently,\\n`svc_export_put` and `expkey_put` will be invoked, leading to two\\nissues:\\n\\n1. The `svc_export_put` will directly free ex_uuid. However,\\n   `e_show`/`c_show` will access `ex_uuid` after `cache_put`, which can\\n   trigger a use-after-free issue, shown below.\\n\\n   ==================================================================\\n   BUG: KASAN: slab-use-after-free in svc_export_show+0x362/0x430 [nfsd]\\n   Read of size 1 at addr ff11000010fdc120 by task cat/870\\n\\n   CPU: 1 UID: 0 PID: 870 Comm: cat Not tainted 6.12.0-rc3+ #1\\n   Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS\\n   1.16.1-2.fc37 04/01/2014\\n   Call Trace:\\n    \u003cTASK\u003e\\n    dump_stack_lvl+0x53/0x70\\n    print_address_description.constprop.0+0x2c/0x3a0\\n    print_report+0xb9/0x280\\n    kasan_report+0xae/0xe0\\n    svc_export_show+0x362/0x430 [nfsd]\\n    c_show+0x161/0x390 [sunrpc]\\n    seq_read_iter+0x589/0x770\\n    seq_read+0x1e5/0x270\\n    proc_reg_read+0xe1/0x140\\n    vfs_read+0x125/0x530\\n    ksys_read+0xc1/0x160\\n    do_syscall_64+0x5f/0x170\\n    entry_SYSCALL_64_after_hwframe+0x76/0x7e\\n\\n   Allocated by task 830:\\n    kasan_save_stack+0x20/0x40\\n    kasan_save_track+0x14/0x30\\n    __kasan_kmalloc+0x8f/0xa0\\n    __kmalloc_node_track_caller_noprof+0x1bc/0x400\\n    kmemdup_noprof+0x22/0x50\\n    svc_export_parse+0x8a9/0xb80 [nfsd]\\n    cache_do_downcall+0x71/0xa0 [sunrpc]\\n    cache_write_procfs+0x8e/0xd0 [sunrpc]\\n    proc_reg_write+0xe1/0x140\\n    vfs_write+0x1a5/0x6d0\\n    ksys_write+0xc1/0x160\\n    do_syscall_64+0x5f/0x170\\n    entry_SYSCALL_64_after_hwframe+0x76/0x7e\\n\\n   Freed by task 868:\\n    kasan_save_stack+0x20/0x40\\n    kasan_save_track+0x14/0x30\\n    kasan_save_free_info+0x3b/0x60\\n    __kasan_slab_free+0x37/0x50\\n    kfree+0xf3/0x3e0\\n    svc_export_put+0x87/0xb0 [nfsd]\\n    cache_purge+0x17f/0x1f0 [sunrpc]\\n    nfsd_destroy_serv+0x226/0x2d0 [nfsd]\\n    nfsd_svc+0x125/0x1e0 [nfsd]\\n    write_threads+0x16a/0x2a0 [nfsd]\\n    nfsctl_transaction_write+0x74/0xa0 [nfsd]\\n    vfs_write+0x1a5/0x6d0\\n    ksys_write+0xc1/0x160\\n    do_syscall_64+0x5f/0x170\\n    entry_SYSCALL_64_after_hwframe+0x76/0x7e\\n\\n2. We cannot sleep while using `rcu_read_lock`/`rcu_read_unlock`.\\n   However, `svc_export_put`/`expkey_put` will call path_put, which\\n   subsequently triggers a sleeping operation due to the following\\n   `dput`.\\n\\n   =============================\\n   WARNING: suspicious RCU usage\\n   5.10.0-dirty #141 Not tainted\\n   -----------------------------\\n   ...\\n   Call Trace:\\n   dump_stack+0x9a/0xd0\\n   ___might_sleep+0x231/0x240\\n   dput+0x39/0x600\\n   path_put+0x1b/0x30\\n   svc_export_put+0x17/0x80\\n   e_show+0x1c9/0x200\\n   seq_read_iter+0x63f/0x7c0\\n   seq_read+0x226/0x2d0\\n   vfs_read+0x113/0x2c0\\n   ksys_read+0xc9/0x170\\n   do_syscall_64+0x33/0x40\\n   entry_SYSCALL_64_after_hwframe+0x67/0xd1\\n\\nFix these issues by using `rcu_work` to help release\\n`svc_expkey`/`svc_export`. This approach allows for an asynchronous\\ncontext to invoke `path_put` and also facilitates the freeing of\\n`uuid/exp/key` after an RCU grace period.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: nfsd: release svc_expkey/svc_export with rcu_work La \\u00faltima referencia para `cache_head` se puede reducir a cero en `c_show` y `e_show` (usando `rcu_read_lock` y `rcu_read_unlock`). En consecuencia, se invocar\\u00e1n `svc_export_put` y `expkey_put`, lo que provocar\\u00e1 dos problemas: 1. `svc_export_put` liberar\\u00e1 directamente ex_uuid. Sin embargo, `e_show`/`c_show` acceder\\u00e1 a `ex_uuid` despu\\u00e9s de `cache_put`, lo que puede desencadenar un problema de use-after-free, que se muestra a continuaci\\u00f3n. ====================================================================== ERROR: KASAN: slab-use-after-free en svc_export_show+0x362/0x430 [nfsd] Lectura de tama\\u00f1o 1 en la direcci\\u00f3n ff11000010fdc120 por la tarea cat/870 CPU: 1 UID: 0 PID: 870 Comm: cat No contaminado 6.12.0-rc3+ #1 Nombre del hardware: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 Seguimiento de llamadas:  dump_stack_lvl+0x53/0x70 imprimir_direcci\\u00f3n_descripci\\u00f3n.constprop.0+0x2c/0x3a0 imprimir_informe+0xb9/0x280 kasan_informe+0xae/0xe0 svc_export_show+0x362/0x430 [nfsd] c_show+0x161/0x390 [sunrpc] seq_read_iter+0x589/0x770 seq_read+0x1e5/0x270 proc_reg_read+0xe1/0x140 vfs_read+0x125/0x530 ksys_read+0xc1/0x160 hacer_syscall_64+0x5f/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e Asignado por la tarea 830: kasan_save_stack+0x20/0x40 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x8f/0xa0 __kmalloc_node_track_caller_noprof+0x1bc/0x400 kmemdup_noprof+0x22/0x50 svc_export_parse+0x8a9/0xb80 [nfsd] cache_do_downcall+0x71/0xa0 [sunrpc] cache_write_procfs+0x8e/0xd0 [sunrpc] proc_reg_write+0xe1/0x140 vfs_write+0x1a5/0x6d0 ksys_write+0xc1/0x160 do_syscall_64+0x5f/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e Liberado por la tarea 868: kasan_save_stack+0x20/0x40 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 __kasan_slab_free+0x37/0x50 kfree+0xf3/0x3e0 svc_export_put+0x87/0xb0 [nfsd] cache_purge+0x17f/0x1f0 [sunrpc] nfsd_destroy_serv+0x226/0x2d0 [nfsd] 2. No podemos dormir mientras usamos `rcu_read_lock`/`rcu_read_unlock`. Sin embargo, `svc_export_put`/`expkey_put` llamar\\u00e1 a path_put, que posteriormente activa una operaci\\u00f3n de dormir debido al siguiente `dput`. ============================== ADVERTENCIA: uso sospechoso de RCU 5.10.0-dirty #141 No contaminado ----------------------------- ... Seguimiento de llamadas: dump_stack+0x9a/0xd0 ___might_sleep+0x231/0x240 dput+0x39/0x600 path_put+0x1b/0x30 svc_export_put+0x17/0x80 e_show+0x1c9/0x200 seq_read_iter+0x63f/0x7c0 seq_read+0x226/0x2d0 vfs_read+0x113/0x2c0 ksys_read+0xc9/0x170 do_syscall_64+0x33/0x40 entry_SYSCALL_64_after_hwframe+0x67/0xd1 Solucione estos problemas utilizando `rcu_work` para ayudar a liberar `svc_expkey`/`svc_export`. Este enfoque permite que un contexto asincr\\u00f3nico invoque `path_put` y tambi\\u00e9n facilita la liberaci\\u00f3n de `uuid/exp/key` despu\\u00e9s de un per\\u00edodo de gracia de RCU.\"}]",
      "id": "CVE-2024-53216",
      "lastModified": "2024-12-27T14:15:29.587",
      "published": "2024-12-27T14:15:29.587",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/2e4854599200f4d021df8ae17e69221d7c149f3e\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/ad4363a24a5746b257c0beb5d8cc68f9b62c173f\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/bd8524148dd8c123334b066faa90590ba2ef8e6f\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/f8c989a0c89a75d30f899a7cabdc14d72522bb8d\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "microsoft_vex": {
      "current_release_date": "2026-03-31T15:11:27.000Z",
      "cve": "CVE-2024-53216",
      "id": "msrc_CVE-2024-53216",
      "initial_release_date": "2024-12-02T00:00:00.000Z",
      "product_status:known_affected": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "nfsd: release svc_expkey/svc_export with rcu_work",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-53216.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-53216\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-12-27T14:15:29.587\",\"lastModified\":\"2026-06-17T08:08:36.987\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnfsd: release svc_expkey/svc_export with rcu_work\\n\\nThe last reference for `cache_head` can be reduced to zero in `c_show`\\nand `e_show`(using `rcu_read_lock` and `rcu_read_unlock`). Consequently,\\n`svc_export_put` and `expkey_put` will be invoked, leading to two\\nissues:\\n\\n1. The `svc_export_put` will directly free ex_uuid. However,\\n   `e_show`/`c_show` will access `ex_uuid` after `cache_put`, which can\\n   trigger a use-after-free issue, shown below.\\n\\n   ==================================================================\\n   BUG: KASAN: slab-use-after-free in svc_export_show+0x362/0x430 [nfsd]\\n   Read of size 1 at addr ff11000010fdc120 by task cat/870\\n\\n   CPU: 1 UID: 0 PID: 870 Comm: cat Not tainted 6.12.0-rc3+ #1\\n   Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS\\n   1.16.1-2.fc37 04/01/2014\\n   Call Trace:\\n    \u003cTASK\u003e\\n    dump_stack_lvl+0x53/0x70\\n    print_address_description.constprop.0+0x2c/0x3a0\\n    print_report+0xb9/0x280\\n    kasan_report+0xae/0xe0\\n    svc_export_show+0x362/0x430 [nfsd]\\n    c_show+0x161/0x390 [sunrpc]\\n    seq_read_iter+0x589/0x770\\n    seq_read+0x1e5/0x270\\n    proc_reg_read+0xe1/0x140\\n    vfs_read+0x125/0x530\\n    ksys_read+0xc1/0x160\\n    do_syscall_64+0x5f/0x170\\n    entry_SYSCALL_64_after_hwframe+0x76/0x7e\\n\\n   Allocated by task 830:\\n    kasan_save_stack+0x20/0x40\\n    kasan_save_track+0x14/0x30\\n    __kasan_kmalloc+0x8f/0xa0\\n    __kmalloc_node_track_caller_noprof+0x1bc/0x400\\n    kmemdup_noprof+0x22/0x50\\n    svc_export_parse+0x8a9/0xb80 [nfsd]\\n    cache_do_downcall+0x71/0xa0 [sunrpc]\\n    cache_write_procfs+0x8e/0xd0 [sunrpc]\\n    proc_reg_write+0xe1/0x140\\n    vfs_write+0x1a5/0x6d0\\n    ksys_write+0xc1/0x160\\n    do_syscall_64+0x5f/0x170\\n    entry_SYSCALL_64_after_hwframe+0x76/0x7e\\n\\n   Freed by task 868:\\n    kasan_save_stack+0x20/0x40\\n    kasan_save_track+0x14/0x30\\n    kasan_save_free_info+0x3b/0x60\\n    __kasan_slab_free+0x37/0x50\\n    kfree+0xf3/0x3e0\\n    svc_export_put+0x87/0xb0 [nfsd]\\n    cache_purge+0x17f/0x1f0 [sunrpc]\\n    nfsd_destroy_serv+0x226/0x2d0 [nfsd]\\n    nfsd_svc+0x125/0x1e0 [nfsd]\\n    write_threads+0x16a/0x2a0 [nfsd]\\n    nfsctl_transaction_write+0x74/0xa0 [nfsd]\\n    vfs_write+0x1a5/0x6d0\\n    ksys_write+0xc1/0x160\\n    do_syscall_64+0x5f/0x170\\n    entry_SYSCALL_64_after_hwframe+0x76/0x7e\\n\\n2. We cannot sleep while using `rcu_read_lock`/`rcu_read_unlock`.\\n   However, `svc_export_put`/`expkey_put` will call path_put, which\\n   subsequently triggers a sleeping operation due to the following\\n   `dput`.\\n\\n   =============================\\n   WARNING: suspicious RCU usage\\n   5.10.0-dirty #141 Not tainted\\n   -----------------------------\\n   ...\\n   Call Trace:\\n   dump_stack+0x9a/0xd0\\n   ___might_sleep+0x231/0x240\\n   dput+0x39/0x600\\n   path_put+0x1b/0x30\\n   svc_export_put+0x17/0x80\\n   e_show+0x1c9/0x200\\n   seq_read_iter+0x63f/0x7c0\\n   seq_read+0x226/0x2d0\\n   vfs_read+0x113/0x2c0\\n   ksys_read+0xc9/0x170\\n   do_syscall_64+0x33/0x40\\n   entry_SYSCALL_64_after_hwframe+0x67/0xd1\\n\\nFix these issues by using `rcu_work` to help release\\n`svc_expkey`/`svc_export`. This approach allows for an asynchronous\\ncontext to invoke `path_put` and also facilitates the freeing of\\n`uuid/exp/key` after an RCU grace period.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: nfsd: release svc_expkey/svc_export with rcu_work La \u00faltima referencia para `cache_head` se puede reducir a cero en `c_show` y `e_show` (usando `rcu_read_lock` y `rcu_read_unlock`). En consecuencia, se invocar\u00e1n `svc_export_put` y `expkey_put`, lo que provocar\u00e1 dos problemas: 1. `svc_export_put` liberar\u00e1 directamente ex_uuid. Sin embargo, `e_show`/`c_show` acceder\u00e1 a `ex_uuid` despu\u00e9s de `cache_put`, lo que puede desencadenar un problema de use-after-free, que se muestra a continuaci\u00f3n. ====================================================================== ERROR: KASAN: slab-use-after-free en svc_export_show+0x362/0x430 [nfsd] Lectura de tama\u00f1o 1 en la direcci\u00f3n ff11000010fdc120 por la tarea cat/870 CPU: 1 UID: 0 PID: 870 Comm: cat No contaminado 6.12.0-rc3+ #1 Nombre del hardware: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 Seguimiento de llamadas:  dump_stack_lvl+0x53/0x70 imprimir_direcci\u00f3n_descripci\u00f3n.constprop.0+0x2c/0x3a0 imprimir_informe+0xb9/0x280 kasan_informe+0xae/0xe0 svc_export_show+0x362/0x430 [nfsd] c_show+0x161/0x390 [sunrpc] seq_read_iter+0x589/0x770 seq_read+0x1e5/0x270 proc_reg_read+0xe1/0x140 vfs_read+0x125/0x530 ksys_read+0xc1/0x160 hacer_syscall_64+0x5f/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e Asignado por la tarea 830: kasan_save_stack+0x20/0x40 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x8f/0xa0 __kmalloc_node_track_caller_noprof+0x1bc/0x400 kmemdup_noprof+0x22/0x50 svc_export_parse+0x8a9/0xb80 [nfsd] cache_do_downcall+0x71/0xa0 [sunrpc] cache_write_procfs+0x8e/0xd0 [sunrpc] proc_reg_write+0xe1/0x140 vfs_write+0x1a5/0x6d0 ksys_write+0xc1/0x160 do_syscall_64+0x5f/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e Liberado por la tarea 868: kasan_save_stack+0x20/0x40 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 __kasan_slab_free+0x37/0x50 kfree+0xf3/0x3e0 svc_export_put+0x87/0xb0 [nfsd] cache_purge+0x17f/0x1f0 [sunrpc] nfsd_destroy_serv+0x226/0x2d0 [nfsd] 2. No podemos dormir mientras usamos `rcu_read_lock`/`rcu_read_unlock`. Sin embargo, `svc_export_put`/`expkey_put` llamar\u00e1 a path_put, que posteriormente activa una operaci\u00f3n de dormir debido al siguiente `dput`. ============================== ADVERTENCIA: uso sospechoso de RCU 5.10.0-dirty #141 No contaminado ----------------------------- ... Seguimiento de llamadas: dump_stack+0x9a/0xd0 ___might_sleep+0x231/0x240 dput+0x39/0x600 path_put+0x1b/0x30 svc_export_put+0x17/0x80 e_show+0x1c9/0x200 seq_read_iter+0x63f/0x7c0 seq_read+0x226/0x2d0 vfs_read+0x113/0x2c0 ksys_read+0xc9/0x170 do_syscall_64+0x33/0x40 entry_SYSCALL_64_after_hwframe+0x67/0xd1 Solucione estos problemas utilizando `rcu_work` para ayudar a liberar `svc_expkey`/`svc_export`. Este enfoque permite que un contexto asincr\u00f3nico invoque `path_put` y tambi\u00e9n facilita la liberaci\u00f3n de `uuid/exp/key` despu\u00e9s de un per\u00edodo de gracia de RCU.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/nfsd/export.c\",\"fs/nfsd/export.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"9ceddd9da13434a5906255c0fc528c385aded283\",\"lessThan\":\"bd8524148dd8c123334b066faa90590ba2ef8e6f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9ceddd9da13434a5906255c0fc528c385aded283\",\"lessThan\":\"2e4854599200f4d021df8ae17e69221d7c149f3e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9ceddd9da13434a5906255c0fc528c385aded283\",\"lessThan\":\"ad4363a24a5746b257c0beb5d8cc68f9b62c173f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9ceddd9da13434a5906255c0fc528c385aded283\",\"lessThan\":\"f8c989a0c89a75d30f899a7cabdc14d72522bb8d\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/nfsd/export.c\",\"fs/nfsd/export.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.20\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.20\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.64\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11.11\",\"lessThanOrEqual\":\"6.11.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.2\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-02-11T15:43:16.959079Z\",\"id\":\"CVE-2024-53216\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"6.6.64\",\"matchCriteriaId\":\"D42B3E7C-85DF-4DBF-A6EC-E45F69FF2DCA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.11.11\",\"matchCriteriaId\":\"21434379-192D-472F-9B54-D45E3650E893\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.12\",\"versionEndExcluding\":\"6.12.2\",\"matchCriteriaId\":\"D8882B1B-2ABC-4838-AC1D-DBDBB5764776\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2e4854599200f4d021df8ae17e69221d7c149f3e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ad4363a24a5746b257c0beb5d8cc68f9b62c173f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bd8524148dd8c123334b066faa90590ba2ef8e6f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f8c989a0c89a75d30f899a7cabdc14d72522bb8d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-28T08:15:19+00:00",
      "cve": "CVE-2024-53216",
      "id": "CVE-2024-53216",
      "initial_release_date": "2024-12-27T00:00:00+00:00",
      "product_status:fixed": "919",
      "product_status:known_affected": "112",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: nfsd: release svc_expkey/svc_export with rcu_work",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-53216.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-03T00:19:33Z",
      "cve": "CVE-2024-53216",
      "id": "CVE-2024-53216",
      "initial_release_date": "2024-12-28T03:50:06Z",
      "product_status:known_affected": "666",
      "product_status:known_not_affected": "221",
      "product_status:recommended": "443",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-53216",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-53216.json",
      "version": "66"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-53216\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-02-11T15:43:16.959079Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-02-11T15:43:18.412Z\"}}], \"cna\": {\"title\": \"nfsd: release svc_expkey/svc_export with rcu_work\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"9ceddd9da13434a5906255c0fc528c385aded283\", \"lessThan\": \"bd8524148dd8c123334b066faa90590ba2ef8e6f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9ceddd9da13434a5906255c0fc528c385aded283\", \"lessThan\": \"2e4854599200f4d021df8ae17e69221d7c149f3e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9ceddd9da13434a5906255c0fc528c385aded283\", \"lessThan\": \"ad4363a24a5746b257c0beb5d8cc68f9b62c173f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9ceddd9da13434a5906255c0fc528c385aded283\", \"lessThan\": \"f8c989a0c89a75d30f899a7cabdc14d72522bb8d\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/nfsd/export.c\", \"fs/nfsd/export.h\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.20\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.20\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.64\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.11\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.13\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/nfsd/export.c\", \"fs/nfsd/export.h\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/bd8524148dd8c123334b066faa90590ba2ef8e6f\"}, {\"url\": \"https://git.kernel.org/stable/c/2e4854599200f4d021df8ae17e69221d7c149f3e\"}, {\"url\": \"https://git.kernel.org/stable/c/ad4363a24a5746b257c0beb5d8cc68f9b62c173f\"}, {\"url\": \"https://git.kernel.org/stable/c/f8c989a0c89a75d30f899a7cabdc14d72522bb8d\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnfsd: release svc_expkey/svc_export with rcu_work\\n\\nThe last reference for `cache_head` can be reduced to zero in `c_show`\\nand `e_show`(using `rcu_read_lock` and `rcu_read_unlock`). Consequently,\\n`svc_export_put` and `expkey_put` will be invoked, leading to two\\nissues:\\n\\n1. The `svc_export_put` will directly free ex_uuid. However,\\n   `e_show`/`c_show` will access `ex_uuid` after `cache_put`, which can\\n   trigger a use-after-free issue, shown below.\\n\\n   ==================================================================\\n   BUG: KASAN: slab-use-after-free in svc_export_show+0x362/0x430 [nfsd]\\n   Read of size 1 at addr ff11000010fdc120 by task cat/870\\n\\n   CPU: 1 UID: 0 PID: 870 Comm: cat Not tainted 6.12.0-rc3+ #1\\n   Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS\\n   1.16.1-2.fc37 04/01/2014\\n   Call Trace:\\n    \u003cTASK\u003e\\n    dump_stack_lvl+0x53/0x70\\n    print_address_description.constprop.0+0x2c/0x3a0\\n    print_report+0xb9/0x280\\n    kasan_report+0xae/0xe0\\n    svc_export_show+0x362/0x430 [nfsd]\\n    c_show+0x161/0x390 [sunrpc]\\n    seq_read_iter+0x589/0x770\\n    seq_read+0x1e5/0x270\\n    proc_reg_read+0xe1/0x140\\n    vfs_read+0x125/0x530\\n    ksys_read+0xc1/0x160\\n    do_syscall_64+0x5f/0x170\\n    entry_SYSCALL_64_after_hwframe+0x76/0x7e\\n\\n   Allocated by task 830:\\n    kasan_save_stack+0x20/0x40\\n    kasan_save_track+0x14/0x30\\n    __kasan_kmalloc+0x8f/0xa0\\n    __kmalloc_node_track_caller_noprof+0x1bc/0x400\\n    kmemdup_noprof+0x22/0x50\\n    svc_export_parse+0x8a9/0xb80 [nfsd]\\n    cache_do_downcall+0x71/0xa0 [sunrpc]\\n    cache_write_procfs+0x8e/0xd0 [sunrpc]\\n    proc_reg_write+0xe1/0x140\\n    vfs_write+0x1a5/0x6d0\\n    ksys_write+0xc1/0x160\\n    do_syscall_64+0x5f/0x170\\n    entry_SYSCALL_64_after_hwframe+0x76/0x7e\\n\\n   Freed by task 868:\\n    kasan_save_stack+0x20/0x40\\n    kasan_save_track+0x14/0x30\\n    kasan_save_free_info+0x3b/0x60\\n    __kasan_slab_free+0x37/0x50\\n    kfree+0xf3/0x3e0\\n    svc_export_put+0x87/0xb0 [nfsd]\\n    cache_purge+0x17f/0x1f0 [sunrpc]\\n    nfsd_destroy_serv+0x226/0x2d0 [nfsd]\\n    nfsd_svc+0x125/0x1e0 [nfsd]\\n    write_threads+0x16a/0x2a0 [nfsd]\\n    nfsctl_transaction_write+0x74/0xa0 [nfsd]\\n    vfs_write+0x1a5/0x6d0\\n    ksys_write+0xc1/0x160\\n    do_syscall_64+0x5f/0x170\\n    entry_SYSCALL_64_after_hwframe+0x76/0x7e\\n\\n2. We cannot sleep while using `rcu_read_lock`/`rcu_read_unlock`.\\n   However, `svc_export_put`/`expkey_put` will call path_put, which\\n   subsequently triggers a sleeping operation due to the following\\n   `dput`.\\n\\n   =============================\\n   WARNING: suspicious RCU usage\\n   5.10.0-dirty #141 Not tainted\\n   -----------------------------\\n   ...\\n   Call Trace:\\n   dump_stack+0x9a/0xd0\\n   ___might_sleep+0x231/0x240\\n   dput+0x39/0x600\\n   path_put+0x1b/0x30\\n   svc_export_put+0x17/0x80\\n   e_show+0x1c9/0x200\\n   seq_read_iter+0x63f/0x7c0\\n   seq_read+0x226/0x2d0\\n   vfs_read+0x113/0x2c0\\n   ksys_read+0xc9/0x170\\n   do_syscall_64+0x33/0x40\\n   entry_SYSCALL_64_after_hwframe+0x67/0xd1\\n\\nFix these issues by using `rcu_work` to help release\\n`svc_expkey`/`svc_export`. This approach allows for an asynchronous\\ncontext to invoke `path_put` and also facilitates the freeing of\\n`uuid/exp/key` after an RCU grace period.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.64\", \"versionStartIncluding\": \"4.20\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.11\", \"versionStartIncluding\": \"4.20\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.2\", \"versionStartIncluding\": \"4.20\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.13\", \"versionStartIncluding\": \"4.20\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T09:56:09.255Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-53216\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-04T09:56:09.255Z\", \"dateReserved\": \"2024-11-19T17:17:25.024Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-12-27T13:50:01.869Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.