In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nfsd: gate nfs3 setacl by argp->mask<\/p>\n
nfsd3_proc_setacl() calls set_posix_acl() unconditionally for both
\nACL_TYPE_ACCESS and ACL_TYPE_DEFAULT, passing argp->acl_access and
\nargp->acl_default verbatim. The NFSv3 ACL decoder only populates
\nthose pointers when the corresponding mask bit is set:<\/p>\n
nfs3svc_decode_setaclargs()
\n if (args->mask & NFS_ACL) decode into acl_access
\n if (args->mask & NFS_DFACL) decode into acl_default
\n \/* otherwise the pointer stays NULL (pc_argzero) *\/<\/p>\n
nfsd3_proc_setacl()
\n set_posix_acl(.., ACL_TYPE_ACCESS, argp->acl_access)
\n set_posix_acl(.., ACL_TYPE_DEFAULT, argp->acl_default)<\/p>\n
set_posix_acl(idmap, dentry, type, NULL) is the VFS “remove this
\nACL type” operation. A NULL pointer that means “the client did not
\nsend this arm” is therefore indistinguishable from “the client
\nasked to remove this ACL”. A SETACL with mask=NFS_ACL silently
\ndrops the directory’s default ACL; mask=0 drops both.<\/p>\n
The sibling nfsd3_proc_getacl() already consults argp->mask before
\ntouching each arm; mirror that in setacl.<\/p>\n
Fix by wrapping each set_posix_acl() call in the matching mask bit
\ncheck and initializing error to 0 before inode_lock so that a
\nrequest with neither bit set leaves the on-disk ACLs untouched and
\nreturns nfs_ok. The out_drop_lock path and the unconditional
\nposix_acl_release() at out: are preserved; both NULL-tolerate the
\nskipped arms.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nfsd: gate nfs3 setacl by argp->mask<\/p>\n
nfsd3_proc_setacl() calls set_posix_acl() unconditionally for both
\nACL_TYPE_ACCESS and ACL_TY<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21593","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21593","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21593"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21593"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21593"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}