In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
NFSD: Guard admin state-revocation walks with NFSD_NET_UP<\/p>\n
Writing to \/proc\/fs\/nfsd\/unlock_filesystem, or sending the
\nNFSD_CMD_UNLOCK_FILESYSTEM or NFSD_CMD_UNLOCK_EXPORT netlink command,
\nwalks the NFSv4 client hash tables to revoke open state and cancel
\nasync COPY operations. All three handlers gate that walk on
\nnn->nfsd_serv, but a listener added via portlist or netlink
\nlistener_set sets nn->nfsd_serv before any nfsd thread starts.
\nnfsd_startup_net() has not yet allocated nn->conf_id_hashtbl, so the
\nwalkers dereference a NULL table. A local administrator with
\nCAP_SYS_ADMIN can crash the kernel this way without ever starting the
\nserver.<\/p>\n
nn->nfsd_serv is set when the service is created, which precedes
\ntable allocation. NFSD_NET_UP instead brackets the window where the
\ntables are live: set at the end of nfsd_startup_net() and cleared in
\nnfsd_shutdown_net() after they are freed, both under nfsd_mutex.
\nGating the three unlock paths on NFSD_NET_UP fixes the startup-time
\nNULL dereference while preserving the earlier post-shutdown
\nuse-after-free fix.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
NFSD: Guard admin state-revocation walks with NFSD_NET_UP<\/p>\n
Writing to \/proc\/fs\/nfsd\/unlock_filesystem, or sending the
\nNFSD_CMD_UNLO<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-24727","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/24727","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=24727"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=24727"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=24727"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}