Linux Kernel 9p Component Walk Error Handling Vulnerability Leading to Use-After-Free

A vulnerability in the Linux kernel's 9p file system handling can cause a use-after-free or reference count underflow. This issue arises in the 'p9_client_walk()' function when the 'clone' parameter is set to false. In this scenario, the file identifier (fid) being used can mistakenly reference an old fid, which is still expected to be valid by the caller. If the walk operation fails after the request has been sent, the error handling process unconditionally releases the reference to the old fid. This premature release can lead to the old fid being destroyed while it is still in use, causing a use-after-free condition. The vulnerability can be triggered when a multi-component walk is divided into separate 'p9_client_walk()' calls, and a subsequent non-cloning walk fails. A reproducer for this vulnerability, along with reference count warning logs, is available upon request.

Impact

Exploitation of this vulnerability can lead to a use-after-free condition or a reference count underflow, both of which can cause memory corruption issues.

Reproduction

To reproduce this vulnerability, initiate a multi-component walk using 'p9_client_walk()' calls. Ensure that the 'clone' parameter is set to false, which will cause the fid to alias the old fid. After sending the request, introduce a failure in the later non-cloning walk. This will trigger the error handling path that improperly releases the old fid, creating a use-after-free condition or a reference count underflow.

Remediation

The vulnerability has been fixed in the Linux kernel. Users should upgrade to the latest version.