In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
NFSD: Prevent client use-after-free during delegation revoke<\/p>\n
A delegation stateid holds only a bare pointer to its owning
\nnfs4_client and does not keep it alive. The client survives its
\nstateids only because __destroy_client() drains cl_delegations and
\ncl_revoked before free_client() runs.<\/p>\n
nfs4_laundromat() breaks that invariant: it unhashes an
\nexpired delegation from cl_delegations, drops deleg_lock, then
\nrevoke_delegation() relinks it onto cl_revoked under cl_lock. In that
\nwindow the delegation is on neither list, so client_has_state() can
\nreport no remaining state.<\/p>\n
Every teardown path first requires cl_rpc_users to be zero, but
\nthe laundromat holds no such reference. A client whose recalled
\ndelegation has just timed out can therefore reach free_client()
\nwhile revoke_delegation() is still about to dereference cl_lock,
\na use-after-free.<\/p>\n
Pin the client with cl_rpc_users across the revoke so teardown blocks
\nuntil it completes, then reap the delegation from cl_revoked. A client
\nalready expiring reaps its own, so skip it and leave the delegation on
\ndel_recall_lru.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
NFSD: Prevent client use-after-free during delegation revoke<\/p>\n
A delegation stateid holds only a bare pointer to its owning
\nnfs4_cli<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21581","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21581","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21581"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21581"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21581"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}