In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nfsd: fix posix_acl leak and ignored error in nfsd4_create_file<\/p>\n
nfsd4_create_file() has two bugs in its ACL handling:<\/p>\n
The return value of nfsd4_acl_to_attr() is silently discarded. When
\nthe NFSv4-to-POSIX ACL conversion fails (e.g., -EINVAL for
\nunsupported ACE types), the file is created without any ACL and the
\nclient receives NFS4_OK. This violates RFC 7530\/8881 which require
\nthe server to reject unsupported attributes on CREATE.<\/p>\n
When start_creating() fails after ACL attributes have been populated
\nin attrs (either via nfsd4_acl_to_attr or via ownership transfer from
\nopen->op_dpacl\/op_pacl), the function jumps to out_write which skips
\nnfsd_attrs_free(). The posix_acl allocations are leaked. A client
\ncan trigger this repeatedly with OPEN(CREATE), ACL attributes, and an
\ninvalid filename (e.g., longer than NAME_MAX).<\/p>\n
Fix both by capturing the nfsd4_acl_to_attr() return value and by
\nchanging the early error paths to jump to out instead of out_write.
\nInitialize child to ERR_PTR(-EINVAL) so that end_creating() is safe
\nto call even if start_creating() was never reached.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nfsd: fix posix_acl leak and ignored error in nfsd4_create_file<\/p>\n
nfsd4_create_file() has two bugs in its ACL handling:<\/p>\n
The return <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-14864","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/14864","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=14864"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=14864"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=14864"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}