PT-2026-121957
CVE-2026-98980
·
تاريخ النشر
2026-10-23
·
تاريخ التحديث
2026-10-23
الوصف من
CVSS 3.1
8.8
عاليةالمقاييسAV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
In the Linux kernel, the following vulnerability has been resolved:
namei: don't reveal overmounted entries in refwalk
In rcuwalk the dentry is validated before it is accepted. step into()
step into() rechecks d seq and follow mount rcu() rechecks mount lock.
An entry that gets unlinked in between causes the lookup to retry and
miss.
A refwalk doesn't do this. lookup fast() takes a reference on the hashed
dentry and simply accepts it. So an unlink that happens after the
reference was taken isn't seen by refwalk. That's fine for a simple
file. We just happened to open it before it was unlinked, no problem.
For a mountpoint and specifically a locked mountpoint it very much
isn't. The unlink detaches all mounts and then removes the name. Any
refwalk that hasn't traversed the mounts yet simply reveals the
underlying entry. It's a very narrow window but it can be hit:
reads of a covered file in 60 s, 3 walkers, ~15000 unlinks
no widening 27
that step + 200 us 3741
See the appended patch for a more reliable reproducer.
So check the entry after step into(). unlink(), rmdir() and rename()
mark the dentry with dont mount() before they detach the mounts and
remove the dentry.
So a dentry that is marked with DCACHE CANT MOUNT and is unhashed by the
time its mounts were looked at is a name that was unlinked under the
refwalk. DCACHE CANT MOUNT is read after the mounts were looked up and
it is set before they are detached by detach mounts(). A refwalk that
missed the mounts will see DCACHE CANT MOUNT.
Plain d unlinked() is fine. A rename takes the dentry off its hash chain
but d drop() leaves d hash.pprev set. So only d drop() and a rename
over the dentry unhash it. The only move that flips IS ROOT splices in a
disconnected alias. That doesn't have DCACHE CANT MOUNT set.
Add the to step into slowpath(). ".." and LOOKUP DOWN may legitimately
land on an unhashed directory. A refwalk that crossed onto a mount has
path.mnt different from nd->path.mnt. A dentry that a filesystem dropped
on its own (d invalidate(), d drop()) doesn't have the flag set and is
treated as before.
// SPDX-License-Identifier: GPL-2.0
/*
- unlink covered: unlink a file that is a mountpoint in a detached copy of
- its mount, against walkers that open it through that copy.
- A is a tmpfs with the file f1 (content SECRET F) and the plain file
- MARK A. A' is an open tree(OPEN TREE CLONE) copy of A with MARK A bound
- on A'/f1, held through an O PATH fd on its root once the tree fd is
- closed. Walkers open f1 through that fd while the driver unlinks A/f1,
- where nothing is mounted on it. A walker may read MARK A or get ENOENT.
- A read of SECRET F is a hit: the name was found after its mount was
- gone. The lockless walks use openat2(RESOLVE CACHED).
- usage: unlink covered [-t seconds] [-w walkers] */ #ifndef GNU SOURCE #define GNU SOURCE #endif #include <errno.h> #include <fcntl.h> #include <pthread.h> #include <stdatomic.h> #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <sys/mount.h> #include <sys/stat.h> #include <sys/syscall.h> #include <linux/openat2.h>
#ifndef NR open tree
#define NR open tree 428
#endif
#ifndef NR move mount
#define NR move mount 429
#endif
#ifndef NR openat2
#define NR openat2 437
#endif
#ifndef OPEN TREE CLONE
#define OPEN TREE CLONE 1
#endif
#ifndef OPEN TREE CLOEXEC
#define OPEN TREE CLOEXEC O CLOEXEC
#endif
#ifndef MOVE MOUNT F EMPTY PATH
#define MOVE MOUNT F EMPTY PATH 0x00000004
#endif
#define WORK "/tmp/uc"
#define ADIR WORK "/A"
static int duration = 60, nwalkers = 3;
static atomic int stop, writer waiting;
static pthread rwlock t cur lock = PTHREAD RWLOCK INITIALIZER;
static int cur fd = -1; /* the root of A', -1 while there is none */
static atomic long n unlink, n walk, n mark, n enoent, n othe
---truncated---
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾