In the Linux kernel, the following vulnerability has been resolved:
nfs: use nfsi->rwsem to protect traversal of the file lock list
Lingfeng identified a bug and suggested two solutions, but both appear
to have issues.
Generally, we cannot release flc_lock while iterating over the file lock
list to avoid use-after-free (UAF) problems with file locks. However,
functions like nfs_delegation_claim_locks and nfs4_reclaim_locks cannot
adhere to this rule because recover_lock or nfs4_lock_delegation_recall
may take a long time. To resolve this, NFS switches to using nfsi->rwsem
for the same protection, and nfs_reclaim_locks follows this approach.
Although nfs_delegation_claim_locks uses so_delegreturn_mutex instead,
this is inadequate since a single inode can have multiple nfs4_state
instances. Therefore, the fix is to also use nfsi->rwsem in this case.
Furthermore, after commit c69899a17ca4 ("NFSv4: Update of VFS byte range
lock must be atomic with the stateid update"), the functions
nfs4_locku_done and nfs4_lock_done also break this rule because they
call locks_lock_inode_wait without holding nfsi->rwsem. Simply adding
this protection could cause many deadlocks, so instead, the call to
locks_lock_inode_wait is moved into _nfs4_proc_setlk. Regarding the bug
fixed by commit c69899a17ca4 ("NFSv4: Update of VFS byte range
lock must be atomic with the stateid update"), it has been resolved
after commit 0460253913e5 ("NFSv4: nfs4_do_open() is incorrectly triggering
state recovery") because all slots are drained before calling
nfs4_do_reclaim, which prevents concurrent stateid changes along this path.
Also, nfs_delegation_claim_locks does not cause this concurrency either
since when _nfs4_proc_setlk is called with NFS_DELEGATED_STATE, no RPC is
sent, so nfs4_lock_done is not called. Therefore,
nfs4_lock_delegation_recall from nfs_delegation_claim_locks is the first
time the stateid is set.
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8
AV:N - The bug is in the NFSv4 client and is reachable via network-driven OP_CB_RECALL delegation callbacks and async LOCK/LOCKU RPC completions that invoke nfs_delegation_claim_locks, nfs4_lock_done, and nfs4_locku_done, not only via local flock/fcntl syscalls on a mounted export.
AC:L - Exploitation is a race while walking the inode lock list with flc_lock dropped; an attacker who controls or races concurrent recalls, lock RPC completions, and flock/fcntl operations on the same NFS file can reliably trigger the UAF without uncontrollable layout or rare kernel options.
PR:N - A malicious or compromised NFS server can send CB_RECALL and lock RPC responses over the established NFSv4 session to drive delegation return and lock-completion paths without any local account, capability, or root privileges on the victim client.
UI:N - No victim interaction is required during exploitation once an NFSv4 mount with delegations exists; recalls and lock RPC completions are initiated by the server and client protocol handling while applications may already hold ordinary byte-range locks.
S:U - Exploitation corrupts kernel heap file_lock state in the NFS client on the same host and enables local privilege escalation or denial of service, but does not by itself cross a VM, container, or IOMMU security boundary to another authority.
C:H - The flaw is a kernel heap use-after-free while iterating struct file_lock list entries; freed lock objects can be reallocated and dereferenced, enabling arbitrary kernel memory disclosure in addition to controlled corruption.
I:H - UAF on file_lock structures allows attacker-influenced reuse of freed memory and can be leveraged for arbitrary kernel writes, control-flow hijacking, and privilege escalation rather than only a bounded or transient modification.
A:H - Concurrent lock list corruption can cause kernel oops, panic, or hang during delegation recall, state recovery, or lock RPC completion, and UAF exploitation commonly crashes the system even when used to gain code execution.
| Attack Vector |
Network |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
None |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:N - The bug is in the NFSv4 client and is reachable via network-driven OP_CB_RECALL delegation callbacks and async LOCK/LOCKU RPC completions that invoke nfs_delegation_claim_locks, nfs4_lock_done, and nfs4_locku_done, not only via local flock/fcntl syscalls on a mounted export.
AC:L - Exploitation is a race while walking the inode lock list with flc_lock dropped; an attacker who controls or races concurrent recalls, lock RPC completions, and flock/fcntl operations on the same NFS file can reliably trigger the UAF without uncontrollable layout or rare kernel options.
PR:N - A malicious or compromised NFS server can send CB_RECALL and lock RPC responses over the established NFSv4 session to drive delegation return and lock-completion paths without any local account, capability, or root privileges on the victim client.
UI:N - No victim interaction is required during exploitation once an NFSv4 mount with delegations exists; recalls and lock RPC completions are initiated by the server and client protocol handling while applications may already hold ordinary byte-range locks.
S:U - Exploitation corrupts kernel heap file_lock state in the NFS client on the same host and enables local privilege escalation or denial of service, but does not by itself cross a VM, container, or IOMMU security boundary to another authority.
C:H - The flaw is a kernel heap use-after-free while iterating struct file_lock list entries; freed lock objects can be reallocated and dereferenced, enabling arbitrary kernel memory disclosure in addition to controlled corruption.
I:H - UAF on file_lock structures allows attacker-influenced reuse of freed memory and can be leveraged for arbitrary kernel writes, control-flow hijacking, and privilege escalation rather than only a bounded or transient modification.
A:H - Concurrent lock list corruption can cause kernel oops, panic, or hang during delegation recall, state recovery, or lock RPC completion, and UAF exploitation commonly crashes the system even when used to gain code execution.
CVSS 3.1