In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nfsd: fix null dereference in nfsd4_setattr for deleg timestamp attrs<\/p>\n
When a SETATTR request includes FATTR4_WORD2_TIME_DELEG_ACCESS or
\nFATTR4_WORD2_TIME_DELEG_MODIFY in the attribute bitmap, nfsd4_setattr()
\nsets deleg_attrs=true and calls nfs4_preprocess_stateid_op() to validate
\nthe stateid.<\/p>\n
If the client supplies the NFSv4 “one stateid” (all-0xFF bytes),
\ncheck_special_stateids() returns nfs_ok without populating the output
\nnfs4_stid pointer, because the special-stateid path in
\nnfs4_preprocess_stateid_op() jumps to done: with s==NULL, and the
\n“if (s)” block that would set *cstid is skipped. The local variable `st`
\nremains NULL.<\/p>\n
Back in nfsd4_setattr(), the if (deleg_attrs) block then unconditionally
\ndereferences st->sc_type (at offset 4 from NULL), causing a kernel oops.<\/p>\n
This is remotely triggerable by any NFSv4 client: send COMPOUND [PUTROOTFH,
\nSETATTR(ONE_STATEID, {bmval2=FATTR4_WORD2_TIME_DELEG_ACCESS, …})].
\nNo authentication, delegation, or prior state is required.<\/p>\n
Fix by adding a NULL check before the dereference. A special stateid is
\nnot a delegation stateid, so the existing nfserr_bad_stateid return value
\nis already correct; we only need to guard the pointer dereference itself.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nfsd: fix null dereference in nfsd4_setattr for deleg timestamp attrs<\/p>\n
When a SETATTR request includes FATTR4_WORD2_TIME_DELEG_ACCE<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21601","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21601","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21601"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21601"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21601"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}