In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
lockd, nfsd: RCU-protect nlmsvc_ops dispatch<\/p>\n
nlmsvc_ops is published by nfsd_lockd_init() and cleared by
\nnfsd_lockd_shutdown() with plain stores, while lockd dereferences
\nit unguarded from dispatch sites in fs\/lockd\/svcsubs.c. The pointer
\ntargets nfsd’s .rodata and the fopen\/fclose callbacks live in nfsd’s
\n.text, so a stale load after rmmod nfsd results in either a NULL
\nderef or a module-text use-after-free.<\/p>\n
Declare nlmsvc_ops as __rcu, publish via rcu_assign_pointer(), clear
\nvia RCU_INIT_POINTER() + synchronize_rcu(). Add a struct module
\n*owner field to nlmsvc_binding and pin the module across indirect
\ncalls with try_module_get\/module_put. When the binding is torn down,
\nfall back to fput() to avoid leaking struct file references.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
lockd, nfsd: RCU-protect nlmsvc_ops dispatch<\/p>\n
nlmsvc_ops is published by nfsd_lockd_init() and cleared by
\nnfsd_lockd_shutdown() wit<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21631","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21631","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21631"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21631"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21631"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}