In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
kernfs: fix xattr race condition with multiple superblocks<\/p>\n
Multiple superblocks with different namespaces can share the same
\nkernfs_node when kernfs_test_super() finds a matching root but
\ndifferent namespace. This means multiple inodes from different
\nsuperblocks can reference the same kernfs_node->iattr->xattrs
\nstructure.<\/p>\n
The VFS layer only holds per-inode locks during xattr operations,
\nwhich is insufficient to serialize concurrent xattr modifications on
\nthe shared kernfs_node. This can lead to race conditions in
\nsimple_xattr_set() where the lookup->replace\/remove sequence is not
\natomic with respect to operations from other superblocks.<\/p>\n
Fix this by protecting xattr operations with the existing hashed
\nkernfs_locks->open_file_mutex[] array, which is already used to
\nprotect per-node open file data. The hashed mutex array provides
\nscalable per-node serialization (scaled by CPU count, up to 1024 locks
\non 32+ CPU systems) with zero memory overhead.<\/p>\n
Changes:
\n– Rename open_file_mutex[] to node_mutex[] to reflect dual purpose
\n– Add kernfs_node_lock_ptr() and kernfs_node_lock() helpers
\n– Protect simple_xattr_set() calls in kernfs_xattr_set() and
\n kernfs_vfs_user_xattr_set() with the hashed mutex
\n– Update file.c to use new helpers via compatibility wrappers
\n– Update documentation to explain the extended lock usage<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
kernfs: fix xattr race condition with multiple superblocks<\/p>\n
Multiple superblocks with different namespaces can share the same
\nkernf<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-7290","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/7290","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7290"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7290"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7290"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}