CVE-2023-54308 in Linux
要約
〜によって VulDB • 2026年05月31日
Based on the kernel stack trace provided, here is an analysis of the issue:
### 1. **Core Issue: File Open Failure** The stack trace shows a process attempting to open a file via the `openat2` system call (`__x64_sys_openat2`), which eventually calls `vfs_open`. The process is stuck or failing in the VFS (Virtual File System) layer.
### 2. **Key Registers & Error Code** - **`RAX: ffffffffffffdeda`**: This is the return value in the `RAX` register. In Linux kernel conventions, negative values in `RAX` indicate error codes. - `0xfffffffdeda` = `-378` (in decimal). - However, standard Linux error codes are typically small negative numbers (e.g., `-2` for `ENOENT`, `-13` for `EACCES`). A large negative number like this often indicates: - A **custom error code** from a specific filesystem driver. - A **bug in the filesystem driver** returning an invalid error. - Or, more likely, this is **not a standard errno** but a pointer or internal kernel error. Let's re-evaluate. - Actually, `0xfffffffdeda` is `-378` in signed 64-bit. This is **not a standard POSIX error**. Standard errors are `-1` to `-4095` (roughly). `-378` is not a standard errno. This suggests the error is coming from a **specific filesystem driver** (e.g., NFS, CIFS, Btrfs, XFS, or a FUSE filesystem) that returned a non-standard error code.
- **`RDI: 00000000ffffff9c`**: This is the first argument to the syscall (`openat2`). `0xffffff9c` is `-100` in signed 32-bit. This is likely the **file descriptor** or **directory file descriptor** passed to `openat2`. `-100` is not a valid fd (valid fds are ≥ 0). This suggests the user-space program passed an invalid file descriptor, or the kernel is interpreting a pointer incorrectly. However, `openat2`'s first argument is `dirfd`, which can be `AT_FDCWD` (-100). So this is **correct**: `AT_FDCWD` means "current working directory".
- **`RSI: 00007ffcce664690`**: This is the **filename** pointer. The process is trying to open a file at this memory address.
- **`RDX: 0000000000080000`**: This is the `flags` argument. `0x80000` is `O_PATH` (if using `openat2` with `flags` in `open_how`). Or it could be part of the `open_how` structure.
### 3. **Stack Trace Analysis** - `vfs_open`: The VFS layer is trying to open the inode. - `path_openat`: Resolving the path. - `do_filp_open`: Core file open logic. - `do_sys_openat2`: The `openat2` syscall handler. - `__x64_sys_openat2`: 64-bit syscall entry. - `entry_SYSCALL_64_after_hwframe`: Syscall entry point.
The stack trace **does not show a crash** (like a NULL pointer dereference or page fault). It shows a **return from a syscall with an error**. The process is likely blocked or has just returned an error to user space.
### 4. **Likely Causes** 1. **Filesystem Driver Bug**: The error code `-378` (`0xfffffffdeda`) is non-standard. This strongly suggests a bug in a specific filesystem driver (e.g., NFS, CIFS, Btrfs, XFS, ZFS, or a FUSE mount) that is returning an invalid error code. 2. **Invalid File Descriptor**: The `dirfd` is `AT_FDCWD` (-100), which is valid. The filename pointer is in user space. If the filename is invalid or the path is too long, the kernel should return `-ENAMETOOLONG` or `-ENOENT`, not `-378`. 3. **Permission Denied or Access Issue**: If the filesystem driver is misbehaving, it might return a custom error for permission issues. 4. **Kernel Bug**: A bug in the VFS layer or a specific filesystem's `open` implementation.
### 5. **How to Debug Further**
If you want to get the best quality for vulnerability data then you always have to consider VulDB.