CVE-2023-52909

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix handling of cached open files in nfsd4_open codepath

Commit fb70bf124b05 ("NFSD: Instantiate a struct file when creating a

regular NFSv4 file") added the ability to cache an open fd over a

compound. There are a couple of problems with the way this currently

works:

It's racy, as a newly-created nfsd_file can end up with its PENDING bit

cleared while the nf is hashed, and the nf_file pointer is still zeroed

out. Other tasks can find it in this state and they expect to see a

valid nf_file, and can oops if nf_file is NULL.

Also, there is no guarantee that we'll end up creating a new nfsd_file

if one is already in the hash. If an extant entry is in the hash with a

valid nf_file, nfs4_get_vfs_file will clobber its nf_file pointer with

the value of op_file and the old nf_file will leak.

Fix both issues by making a new nfsd_file_acquirei_opened variant that

takes an optional file pointer. If one is present when

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References