CVE-2023-54269

Vulnerability

In the Linux kernel's SUNRPC implementation, a double-free vulnerability exists in the handling of deferred RPC requests. When an RPC request is deferred, the rq_xprt_ctxt pointer is moved from the svc_rqst structure into the svc_deferred_req structure. Upon revisiting the deferred request, the pointer is copied into a new svc_rqst but remains in the svc_deferred_req. If the same request is deferred a second time (a rare scenario), the old svc_deferred_req is reused without clearing the rq_xprt_ctxt pointer. This leads to the context being freed (for UDP) or added to a free list (for RDMA) when xpo_release_xprt is called, while the pointer still exists in the deferred request.

Exploitation

An attacker would need to trigger the specific sequence of events where a request is deferred twice, and subsequently revisited. This is described as a "rare" case, likely requiring specific network conditions or crafted RPC messages. No authentication is explicitly mentioned, but the attack surface is the kernel's network service handling SUNRPC requests. The vulnerability resides in the svc_defer() function, where the fix clears rq_xprt_ctxt after storing it in the deferred request.

Impact

A successful exploit could lead to memory corruption, as freeing the same object twice (double-free) can cause a kernel oops (crash) or potentially be leveraged for privilege escalation. The impact is a denial of service (system crash) with a possibility of arbitrary code execution depending on the kernel memory allocator state.

Mitigation

The vulnerability is fixed in the Linux kernel. Patches have been applied to the stable kernel tree, as referenced in commits [1] and [2]. Users should update to a kernel version containing the fix.