In the Linux kernel, the following vulnerability has been resolved:
sunrpc: harden rq_procinfo lifecycle to prevent double-free
The svc_release_rqst() function executes the callback inside
rqstp->rq_procinfo->pc_release. However, if a worker thread begins
processing a new request and encounters an early error path (e.g.,
unsupported protocol, short frame, or bad auth) before a valid
rq_procinfo is installed, a stale release hook can be re-triggered
against reused state from the previous RPC, resulting in a double-free
or use-after-free vulnerability.
Harden the lifecycle of rq_procinfo by:
1. Ensuring svc_release_rqst() always clears rq_procinfo after the
optional pc_release() call, regardless of whether the hook exists.
2. Explicitly clearing rq_procinfo at request entry in svc_process()
before any early decode or drop paths.
3. Ensuring svc_process_bc() does the same at backchannel entry.
This guarantees that error flows will not encounter a non-NULL stale
rq_procinfo pointer when there is nothing to release.
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8
AV:N - The flaw is in server-side SUNRPC request handling reached from remote RPC over TCP/UDP/RDMA transports used by nfsd and lockd (svc_recv→svc_handle_xprt→svc_process), exploitable by sending crafted ONC/RPC packets to listening NFS/NLM ports.
AC:L - An attacker controls the RPC sequence and timing (valid request then malformed/short/bad-auth/bad-prog packet on the same pooled worker) to reliably re-trigger a stale pc_release without depending on uncontrollable layout or victim state.
PR:N - Trigger paths include pre-authentication failures (garbage credentials, unknown program/version, short frames) that still call svc_release_rqst; stale rq_procinfo can be left by any prior RPC on the same worker, so no attacker credentials are required.
UI:N - Exploitation requires only network RPC traffic to an already-running NFS/NLM server; no end-user actions such as mounting a share or opening files are needed beyond normal server exposure.
S:U - Impact is kernel heap corruption and privilege escalation within the host kernel context; it does not inherently cross a VM, container, or IOMMU security boundary to another authority.
C:H - The bug is an explicit double-free/use-after-free of per-request NFS release state (e.g. nfsd4_release_compoundargs kfree/vfree chains and fh_put paths), enabling arbitrary kernel memory disclosure when exploited.
I:H - Re-invoking pc_release on reused svc_rqst buffers corrupts heap metadata and object lifetimes, providing a standard kernel double-free/UAF primitive suitable for arbitrary write and code execution.
A:H - Repeated or mistimed pc_release calls can immediately panic the kernel via SLUB double-free detection, oops, or wedged nfsd worker threads, causing complete loss of availability on NFS-serving systems.
| Attack Vector |
Network |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
None |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:N - The flaw is in server-side SUNRPC request handling reached from remote RPC over TCP/UDP/RDMA transports used by nfsd and lockd (svc_recv→svc_handle_xprt→svc_process), exploitable by sending crafted ONC/RPC packets to listening NFS/NLM ports.
AC:L - An attacker controls the RPC sequence and timing (valid request then malformed/short/bad-auth/bad-prog packet on the same pooled worker) to reliably re-trigger a stale pc_release without depending on uncontrollable layout or victim state.
PR:N - Trigger paths include pre-authentication failures (garbage credentials, unknown program/version, short frames) that still call svc_release_rqst; stale rq_procinfo can be left by any prior RPC on the same worker, so no attacker credentials are required.
UI:N - Exploitation requires only network RPC traffic to an already-running NFS/NLM server; no end-user actions such as mounting a share or opening files are needed beyond normal server exposure.
S:U - Impact is kernel heap corruption and privilege escalation within the host kernel context; it does not inherently cross a VM, container, or IOMMU security boundary to another authority.
C:H - The bug is an explicit double-free/use-after-free of per-request NFS release state (e.g. nfsd4_release_compoundargs kfree/vfree chains and fh_put paths), enabling arbitrary kernel memory disclosure when exploited.
I:H - Re-invoking pc_release on reused svc_rqst buffers corrupts heap metadata and object lifetimes, providing a standard kernel double-free/UAF primitive suitable for arbitrary write and code execution.
A:H - Repeated or mistimed pc_release calls can immediately panic the kernel via SLUB double-free detection, oops, or wedged nfsd worker threads, causing complete loss of availability on NFS-serving systems.
CVSS 3.1