In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nfsd: release OPEN-decoded posix ACLs via op_release<\/p>\n
nfsd4_decode_createhow4() calls nfsd4_decode_fattr4(), which allocates
\nrefcounted struct posix_acl objects via posix_acl_alloc() and stores
\nthem in open->op_pacl and open->op_dpacl. These pointers must be
\nreleased once the OPEN compound finishes.<\/p>\n
When nfsd4_decode_open_claim4() returns a non-seqid-mutating error,
\nthe dispatcher short-circuits before op_func runs:<\/p>\n
nfsd4_proc_compound()
\n if (op->status && op->opnum == OP_OPEN)
\n op->status = nfsd4_open_omfg(…)
\n if (!seqid_mutating_err(ntohl(op->status)))
\n return op->status; \/* nfsd4_open() never runs *\/
\n …
\n opdesc->op_release(&op->u) \/* must still release op_pacl\/op_dpacl *\/<\/p>\n
Before this change OP_OPEN had no .op_release in nfsd4_ops[], and the
\nrelease pair lived inside nfsd4_open() at its out_err: label. On the
\nshort-circuit path nfsd4_open() is never invoked, so both posix_acl
\nrefs leak on every malformed OPEN compound that carries valid POSIX
\nACL createhow4 attributes.<\/p>\n
Add nfsd4_open_release() and wire it as .op_release for OP_OPEN.
\nposix_acl_release() is NULL-safe, so the single release site covers
\nboth the normal path and the nfsd4_open_omfg short-circuit. Remove
\nthe matching posix_acl_release() pair from nfsd4_open()’s out_err:
\nlabel to avoid double-releasing.<\/p>\n
The compound loop has two encoding branches: nfsd4_encode_operation()
\nfor normal ops, and nfsd4_encode_replay() for v4.0 replayed ops.
\nop_release was only called from nfsd4_encode_operation(), so resources
\nattached to op->u leak on the replay path.<\/p>\n
Move the op_release() call out of nfsd4_encode_operation() and the
\nreplay branch, placing it after the if-else in nfsd4_proc_compound().
\nThis gives a single call site in a fairly obviously-correct place,
\ncovering both the normal encoding and replay paths.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nfsd: release OPEN-decoded posix ACLs via op_release<\/p>\n
nfsd4_decode_createhow4() calls nfsd4_decode_fattr4(), which allocates
\nrefcou<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21586","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21586","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21586"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21586"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21586"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}