| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2024-46682: nfsd: prevent panic for nfsv4.0 closed files in nfs4_show_open |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| nfsd: prevent panic for nfsv4.0 closed files in nfs4_show_open |
| |
| Prior to commit 3f29cc82a84c ("nfsd: split sc_status out of |
| sc_type") states_show() relied on sc_type field to be of valid |
| type before calling into a subfunction to show content of a |
| particular stateid. From that commit, we split the validity of |
| the stateid into sc_status and no longer changed sc_type to 0 |
| while unhashing the stateid. This resulted in kernel oopsing |
| for nfsv4.0 opens that stay around and in nfs4_show_open() |
| would derefence sc_file which was NULL. |
| |
| Instead, for closed open stateids forgo displaying information |
| that relies of having a valid sc_file. |
| |
| To reproduce: mount the server with 4.0, read and close |
| a file and then on the server cat /proc/fs/nfsd/clients/2/states |
| |
| [ 513.590804] Call trace: |
| [ 513.590925] _raw_spin_lock+0xcc/0x160 |
| [ 513.591119] nfs4_show_open+0x78/0x2c0 [nfsd] |
| [ 513.591412] states_show+0x44c/0x488 [nfsd] |
| [ 513.591681] seq_read_iter+0x5d8/0x760 |
| [ 513.591896] seq_read+0x188/0x208 |
| [ 513.592075] vfs_read+0x148/0x470 |
| [ 513.592241] ksys_read+0xcc/0x178 |
| |
| The Linux kernel CVE team has assigned CVE-2024-46682 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 6.9 with commit 3f29cc82a84c23cfd12b903029dd26002ca825f5 and fixed in 6.10.8 with commit ba0b697de298285301c71c258598226e06494236 |
| Issue introduced in 6.9 with commit 3f29cc82a84c23cfd12b903029dd26002ca825f5 and fixed in 6.11 with commit a204501e1743d695ca2930ed25a2be9f8ced96d3 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2024-46682 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| fs/nfsd/nfs4state.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/ba0b697de298285301c71c258598226e06494236 |
| https://git.kernel.org/stable/c/a204501e1743d695ca2930ed25a2be9f8ced96d3 |
