In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
NFSD: Prevent lock owner use-after-free during client teardown<\/p>\n
__destroy_client() releases a client’s open owners, but a lock owner
\nwhose only reference is a blocked lock (nbl) stays on
\ncl_ownerstr_hashtbl. client_has_state() does not count a bare owner,
\nso DESTROY_CLIENTID can reach __destroy_client() with such owners
\npresent.<\/p>\n
__destroy_client() then walks the table, calling remove_blocked_locks()
\non each owner without a reference. Freeing a blocked lock drops the
\nowner reference held via flc_owner. The per-net laundromat reaps
\nblocked locks from nn->blocked_locks_lru independently of client state.
\nThe two paths share blocked_locks_lock only for the list splice, not
\nthe owner’s lifetime. The laundromat therefore frees the owner as
\n__destroy_client() dereferences it, a NULL dereference in
\nremove_blocked_locks().<\/p>\n
nfsd4_release_lockowner() holds a reference across the same call;
\n__destroy_client() does not. Hold cl_lock across the walk, taking a
\nreference and unhashing each owner, then drop it before
\nremove_blocked_locks() and nfs4_put_stateowner(), which take
\nblocked_locks_lock and cl_lock.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
NFSD: Prevent lock owner use-after-free during client teardown<\/p>\n
__destroy_client() releases a client’s open owners, but a lock owne<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21584","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21584","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21584"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21584"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21584"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}