{"id":"CVE-2024-38570","state":"PUBLISHED","title":"gfs2: Fix potential glock use-after-free on unmount","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: Fix potential glock use-after-free on unmount\n\nWhen a DLM lockspace is released and there ares still locks in that\nlockspace, DLM will unlock those locks automatically.  Commit\nfb6791d100d1b started exploiting this behavior to speed up filesystem\nunmount: gfs2 would simply free glocks it didn't want to unlock and then\nrelease the lockspace.  This didn't take the bast callbacks for\nasynchronous lock contention notifications into account, which remain\nactive until until a lock is unlocked or its lockspace is released.\n\nTo prevent those callbacks from accessing deallocated objects, put the\nglocks that should not be unlocked on the sd_dead_glocks list, release\nthe lockspace, and only then free those glocks.\n\nAs an additional measure, ignore unexpected ast and bast callbacks if\nthe receiving glock is dead.","publishedAt":"2024-06-19T13:35:36.274Z","updatedAt":"2026-10-30T12:18:30.366Z","severity":{"score":9.8,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"fb6791d100d1bba20b5cdbc4912e1f7086ec60f8","status":"affected","lessThan":"94b32a85d1a76ae4f1b42a88677fa20b20187729","versionType":"git"},{"version":"fb6791d100d1bba20b5cdbc4912e1f7086ec60f8","status":"affected","lessThan":"0636b34b44589b142700ac137b5f69802cfe2e37","versionType":"git"},{"version":"fb6791d100d1bba20b5cdbc4912e1f7086ec60f8","status":"affected","lessThan":"e42e8a24d7f02d28763d16ca7ec5fc6d1f142af0","versionType":"git"},{"version":"fb6791d100d1bba20b5cdbc4912e1f7086ec60f8","status":"affected","lessThan":"501cd8fabf621d10bd4893e37f6ce6c20523c8ca","versionType":"git"},{"version":"fb6791d100d1bba20b5cdbc4912e1f7086ec60f8","status":"affected","lessThan":"d98779e687726d8f8860f1c54b5687eec5f63a73","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/gfs2/glock.c","fs/gfs2/glock.h","fs/gfs2/incore.h","fs/gfs2/lock_dlm.c","fs/gfs2/ops_fstype.c","fs/gfs2/super.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"3.8","status":"affected"},{"version":"0","status":"unaffected","lessThan":"3.8","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.33","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.8.12","status":"unaffected","lessThanOrEqual":"6.8.*","versionType":"semver"},{"version":"6.9.3","status":"unaffected","lessThanOrEqual":"6.9.*","versionType":"semver"},{"version":"6.10","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/gfs2/glock.c","fs/gfs2/glock.h","fs/gfs2/incore.h","fs/gfs2/lock_dlm.c","fs/gfs2/ops_fstype.c","fs/gfs2/super.c"]}],"references":["https://git.kernel.org/stable/c/94b32a85d1a76ae4f1b42a88677fa20b20187729","https://git.kernel.org/stable/c/0636b34b44589b142700ac137b5f69802cfe2e37","https://git.kernel.org/stable/c/e42e8a24d7f02d28763d16ca7ec5fc6d1f142af0","https://git.kernel.org/stable/c/501cd8fabf621d10bd4893e37f6ce6c20523c8ca","https://git.kernel.org/stable/c/d98779e687726d8f8860f1c54b5687eec5f63a73"],"weaknesses":[],"ingestedAt":"2026-10-30T12:34:06.950Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/38xxx/CVE-2024-38570.json","commit":"db8103c5921aac81d5d90efcf3745980dafabf49","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-38570","state":"PUBLISHED","datePublished":"2024-06-19T13:35:36.274Z","dateUpdated":"2026-10-30T12:18:30.366Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2024-06-18T19:36:34.923Z"},"containers":{"cna":{"title":"gfs2: Fix potential glock use-after-free on unmount","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: Fix potential glock use-after-free on unmount\n\nWhen a DLM lockspace is released and there ares still locks in that\nlockspace, DLM will unlock those locks automatically.  Commit\nfb6791d100d1b started exploiting this behavior to speed up filesystem\nunmount: gfs2 would simply free glocks it didn't want to unlock and then\nrelease the lockspace.  This didn't take the bast callbacks for\nasynchronous lock contention notifications into account, which remain\nactive until until a lock is unlocked or its lockspace is released.\n\nTo prevent those callbacks from accessing deallocated objects, put the\nglocks that should not be unlocked on the sd_dead_glocks list, release\nthe lockspace, and only then free those glocks.\n\nAs an additional measure, ignore unexpected ast and bast callbacks if\nthe receiving glock is dead."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"fb6791d100d1bba20b5cdbc4912e1f7086ec60f8","status":"affected","lessThan":"94b32a85d1a76ae4f1b42a88677fa20b20187729","versionType":"git"},{"version":"fb6791d100d1bba20b5cdbc4912e1f7086ec60f8","status":"affected","lessThan":"0636b34b44589b142700ac137b5f69802cfe2e37","versionType":"git"},{"version":"fb6791d100d1bba20b5cdbc4912e1f7086ec60f8","status":"affected","lessThan":"e42e8a24d7f02d28763d16ca7ec5fc6d1f142af0","versionType":"git"},{"version":"fb6791d100d1bba20b5cdbc4912e1f7086ec60f8","status":"affected","lessThan":"501cd8fabf621d10bd4893e37f6ce6c20523c8ca","versionType":"git"},{"version":"fb6791d100d1bba20b5cdbc4912e1f7086ec60f8","status":"affected","lessThan":"d98779e687726d8f8860f1c54b5687eec5f63a73","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/gfs2/glock.c","fs/gfs2/glock.h","fs/gfs2/incore.h","fs/gfs2/lock_dlm.c","fs/gfs2/ops_fstype.c","fs/gfs2/super.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"3.8","status":"affected"},{"version":"0","status":"unaffected","lessThan":"3.8","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.33","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.8.12","status":"unaffected","lessThanOrEqual":"6.8.*","versionType":"semver"},{"version":"6.9.3","status":"unaffected","lessThanOrEqual":"6.9.*","versionType":"semver"},{"version":"6.10","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/gfs2/glock.c","fs/gfs2/glock.h","fs/gfs2/incore.h","fs/gfs2/lock_dlm.c","fs/gfs2/ops_fstype.c","fs/gfs2/super.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/94b32a85d1a76ae4f1b42a88677fa20b20187729"},{"url":"https://git.kernel.org/stable/c/0636b34b44589b142700ac137b5f69802cfe2e37"},{"url":"https://git.kernel.org/stable/c/e42e8a24d7f02d28763d16ca7ec5fc6d1f142af0"},{"url":"https://git.kernel.org/stable/c/501cd8fabf621d10bd4893e37f6ce6c20523c8ca"},{"url":"https://git.kernel.org/stable/c/d98779e687726d8f8860f1c54b5687eec5f63a73"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL"},"scenarios":[{"lang":"en","value":"AV:N - The use-after-free is driven by a DLM protocol message from a remote cluster node (`receive_bast`/`receive_request` over the DLM TCP/SCTP interconnect), which dispatches `gdlm_bast()` on the already-freed glock. The DLM interconnect is routable IP, not restricted to a single L2 segment.\nAC:L - The attacker fully controls the contention side and can hold conflicting locks on many resources continuously so that a bast is guaranteed to land in the unmount window, which is wide (it spans `truncate_inode_pages_final()` and `gfs2_delete_debugfs_file()`); unmounts of clustered GFS2 volumes are routine and repeatable events in pacemaker-managed clusters, so the race is reliably winnable.\nPR:N - No credentials or privileges on the victim node are needed — the DLM peer's lock request is not authenticated per-user by the target, and an ordinary unprivileged user on any cluster node generates the required contention with plain file access on the shared filesystem.\nUI:N - No victim action is solicited by the attacker; the unmount is a routine cluster/administrative operation and the callback fires automatically from the DLM workqueue.\nS:U - The freed object and the corrupted state are both kernel memory in the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - A use-after-free on a `gfs2_glock` slab object allows the freed allocation to be reclaimed by attacker-influenced data and then read/leaked through glock state and the subsequent `dump_glock_func` path, giving arbitrary kernel-memory disclosure potential.\nI:H - `gfs2_glock_cb()` writes into the freed object (lockref count, `gl_flags`, `gl_demote_state`) and then queues `&gl->gl_work`, so a reallocated object supplies the `delayed_work` timer/work function pointer — a control-flow hijack and arbitrary-write primitive.\nA:H - Even unexploited, the UAF corrupts a spinlock and refcount in freed memory and reaches `BUG_ON`/`BUG()` in `gdlm_ast()`, causing kernel oops or panic on the unmounting node."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-30T12:18:30.366Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.8","versionEndExcluding":"6.1.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.8","versionEndExcluding":"6.6.33"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.8","versionEndExcluding":"6.8.12"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.8","versionEndExcluding":"6.9.3"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.8","versionEndExcluding":"6.10"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/0636b34b44589b142700ac137b5f69802cfe2e37","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/e42e8a24d7f02d28763d16ca7ec5fc6d1f142af0","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/501cd8fabf621d10bd4893e37f6ce6c20523c8ca","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/d98779e687726d8f8860f1c54b5687eec5f63a73","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T04:12:25.837Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-38570","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-09-10T17:14:22.126008Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-09-11T17:34:56.284Z"}}]}}}