CVE-2023-54050

Vulnerability

In the Linux kernel's UBIFS filesystem, a memory leak vulnerability exists in the dirty_cow_znode function. When copy_znode() allocates a new znode and insert_old_idx() subsequently fails, the newly copied znode (zn) is not freed, causing a memory leak [1]. The root cause is that the error handling path does not clean up the allocated znode when the old index insertion fails.

Exploitation

An attacker would need to trigger a failure in insert_old_idx() during a write operation that causes copy-on-write of a znode. This could be achieved by exhausting memory or inducing an error in the underlying storage layer. No special privileges are required beyond the ability to write to a UBIFS filesystem, which is typically accessible to unprivileged users on systems with UBIFS mounts.

Impact

Repeated exploitation leads to gradual memory exhaustion, potentially causing system instability or denial of service denial. The leak is per-operation, so sustained triggering can deplete kernel memory over time.

Mitigation

The fix splits copy_znode() into allocation and replacement phases, and similarly splits insert_old_idx() so that resource cleanup can occur without corrupting metadata. The patch has been applied to address this vulnerability has been applied to the stable kernel tree [1][2][3][4]. Users should update to ares should update to a kernel version containing the fix.