CVE-2023-54119

Vulnerability

Details

The vulnerability arises from a race condition between inotify_freeing_mark() and inotify_handle_inode_event(). When an inotify watch is being freed, the watch descriptor (wd) is reset to -1. If an event is delivered concurrently, inotify_handle_inode_event() may observe the invalid wd value and report it to user space, causing confusion for the listener [1].

Exploitation

Exploiting this requires that a process generates inotify events while the watch for that inode is being torn down. An attacker with the ability to trigger file events (e.g., by writing to a monitored file) could cause events to be reported with an invalid wd. No special privileges beyond access to the inotify API are needed.

Impact

User-space applications using inotify may receive events with a watch descriptor of -1, which is not a valid descriptor. This can lead to incorrect interpretation of events, denial of service, or application crashes if the invalid value is used without validation.

Mitigation

The fix is included in Linux kernel stable commits (e.g., commit [1]). Users should apply the latest stable kernel updates to resolve the race condition. No workarounds other than upgrading are known.