In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
lockd: fix swapped arguments in nlmsvc_match_ip()<\/p>\n
When releasing locks by server IP address via \/proc\/fs\/nfsd\/unlock_ip,
\nnlmsvc_unlock_all_by_ip() calls nlm_traverse_files() with the server
\nsockaddr as the opaque @data argument:<\/p>\n
\tnlm_traverse_files(server_addr, nlmsvc_match_ip, NULL);<\/p>\n
The match callback is later invoked from nlm_traverse_locks() as:<\/p>\n
\tmatch(lockhost, host);<\/p>\n
where the first argument is the nlm_host that owns the lock, and the
\nsecond argument is the @data that was originally passed down (here the
\nserver sockaddr). This is the convention every other match callback
\nrelies on (nlmsvc_mark_host(), nlmsvc_same_host(), nlmsvc_is_client()):
\narg1 is the real nlm_host, arg2 is the caller-supplied reference value.<\/p>\n
nlmsvc_match_ip() has had these two arguments reversed ever since the
\nunlock-by-IP feature was introduced in commit 4373ea84c84d (“lockd:
\nunlock lockd locks associated with a given server ip”):<\/p>\n
\treturn rpc_cmp_addr(nlm_srcaddr(host), datap);<\/p>\n
Here @host is actually the server sockaddr, so nlm_srcaddr(host)
\ndereferences a struct sockaddr as a struct nlm_host and reads garbage
\nat the offset of h_srcaddr; meanwhile @datap is actually the lock
\nowner’s nlm_host but is compared as a sockaddr. As a result the
\ncomparison practically never matches and locks are not released for the
\nrequested IP.<\/p>\n
Swap the arguments so the lock owner’s source address is compared
\nagainst the requested server address:<\/p>\n
\treturn rpc_cmp_addr(nlm_srcaddr(datap), (struct sockaddr *)host);<\/p>\n
[ cel: fix the misleading typedef parameter names too ]<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
lockd: fix swapped arguments in nlmsvc_match_ip()<\/p>\n
When releasing locks by server IP address via \/proc\/fs\/nfsd\/unlock_ip,
\nnlmsvc_un<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-28495","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/28495","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=28495"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=28495"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=28495"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}