In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nfsd: don’t free session slots that are still in use<\/p>\n
nfsd4_sequence() can free the very slot it is currently processing.
\nWhen the session shrinker has reduced se_target_maxslots below
\nse_fchannel.maxreqs, the shrink path checks three conditions before
\ncalling free_session_slots():<\/p>\n
1. se_target_maxslots sl_generation == se_slot_gen (slot is up-to-date)
\n 3. seq->maxslots slotid is never checked against se_target_maxslots.
\nA client using a slot in the range [se_target_maxslots, maxreqs) can
\nsatisfy all three conditions: its slot has the current generation
\n(set by a prior SEQUENCE), and it sends sa_highest_slotid =
\nse_target_maxslots, including the caller’s own slot. The function
\ncontinues to write sl_seqid, sl_flags, sl_generation, and stores the
\ndangling pointer in cstate->slot. Later, nfsd4_store_cache_entry()
\ncopies up to maxresp_cached bytes of the compound reply into the freed
\nsl_data[] array, corrupting whatever slab object now occupies that
\naddress.<\/p>\n
Additionally, a concurrent thread processing SEQUENCE on a different
\nhigh-numbered slot can have its slot freed out from under it.
\nNFSD4_SLOT_INUSE is set under nn->client_lock before the lock is
\nreleased, so any concurrent thread past SEQUENCE will have its slot
\nmarked. However, free_session_slots() does not check NFSD4_SLOT_INUSE
\nbefore freeing.<\/p>\n
Fix both problems by:
\n 1. Checking that the current request’s slotid is below the shrink
\n boundary.
\n 2. Scanning slots in the to-be-freed range for NFSD4_SLOT_INUSE and
\n deferring the shrink if any are active.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nfsd: don’t free session slots that are still in use<\/p>\n
nfsd4_sequence() can free the very slot it is currently processing.
\nWhen the <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21611","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21611","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21611"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21611"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21611"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}