In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
NFSD: Prevent client use-after-free during admin state revocation<\/p>\n
A stateid holds only a bare pointer to its nfs4_client; a stateid
\nreference does not pin it. The client survives only because
\n__destroy_client() drains its stateids before free_client() runs.<\/p>\n
nfsd4_revoke_states() drops nn->client_lock across revoke_one_stid(),
\nwhich dereferences the client to revoke a stateid and read
\nclp->cl_minorversion. A teardown racing the dropped lock can free
\nthe client first.<\/p>\n
Pinning cl_rpc_users under client_lock blocks the DESTROY_CLIENTID and
\nEXCHANGE_ID teardown, which refuses while cl_rpc_users is non-zero.
\nforce_expire_client() ignores it: once its wait for cl_rpc_users to
\nreach zero has passed, a later pin goes unnoticed.<\/p>\n
Under client_lock, skip a client whose cl_time is already zero —
\nforce_expire_client() clears it there before waiting — otherwise pin
\ncl_rpc_users before dropping the lock. The walk then either sees the
\nexpiry and skips, or pins in time for that wait to cover the revoke.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
NFSD: Prevent client use-after-free during admin state revocation<\/p>\n
A stateid holds only a bare pointer to its nfs4_client; a statei<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21582","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21582","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21582"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21582"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21582"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}