In the Linux kernel, the following vulnerability has been resolved:
lockd: Avoid hashing uninitialized bytes in nlm4svc_lookup_file()
file_hash() digests the first LOCKD_FH_HASH_SIZE bytes of
nfs_fh.data when bucketing nlm_files[], independent of fh.size.
Commit 3de744ee4e45 ("lockd: Use xdrgen XDR functions for the
NLMv4 TEST procedure") set .pc_argzero to zero for the converted
procedures and moved file-handle population into
nlm4svc_lookup_file(), which copies only xdr_lock->fh.len bytes
into lock->fh.data.
When an NLMv4 client presents a file handle shorter than
LOCKD_FH_HASH_SIZE, bytes fh.len..31 retain whatever the argument
buffer held from an earlier request. The same wire handle then
hashes to different buckets across calls; nlm_lookup_file() misses
the existing nlm_file entry, and lock-state lookups fail.
Zero only the tail bytes that file_hash() would otherwise consume.
Handles of LOCKD_FH_HASH_SIZE or larger already populate every byte
that file_hash() reads.
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8
AV:N - The bug is reached via remote NLMv4 RPC to in-kernel lockd (TCP/UDP SunRPC, typically alongside nfsd), from svc_process() through nlm4svc_proc_* handlers into nlm4svc_lookup_file() and nlm_lookup_file().
AC:L - An NFS client can reliably trigger this by sending NLMv4 LOCK/TEST/SHARE/etc. with a file handle shorter than 32 bytes; stale tail bytes come from the same worker's prior RPC argument buffer, which the attacker can influence with earlier requests.
PR:N - lockd_authenticate() accepts RPC_AUTH_NULL/RPC_AUTH_UNIX and, for normal procedures, svc_set_client(); no local UID, capabilities, or root in the host namespace is required—only network reachability as an NFS export client (AUTH_NULL is explicitly supported for NLM).
UI:N - Exploitation requires only crafted NLMv4 RPC traffic to a running lockd/nfsd instance; no victim mount, file open, or other interactive action beyond normal NFS client participation.
S:U - Impact is confined to the NFS server's kernel lockd/nfsd authority (file-lock and DOS-share state on exported files); it does not cross VM, container, or IOMMU security boundaries.
C:H - file_hash() sums the first 32 bytes of nfs_fh.data regardless of fh.size; when fh.len<32, bytes fh.len..31 are stale prior-request buffer contents, so each lookup performs an out-of-bounds read of up to 31 bytes used in security-relevant file-table indexing.
I:H - Inconsistent hashing creates duplicate nlm_file entries for the same wire handle; per-entry f_shares and nlm_block state diverge while both open the same inode, enabling DOS share-mode bypass and incorrect lock/block bookkeeping despite VFS-level enforcement.
A:H - Missed nlm_file lookups cause lock-state lookup failures, incorrect NLM responses, hung or failing NFS lock clients, and unbounded duplicate nlm_file/VFS opens that can exhaust server lock-manager resources on production NFS file servers.
| Attack Vector |
Network |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
None |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:N - The bug is reached via remote NLMv4 RPC to in-kernel lockd (TCP/UDP SunRPC, typically alongside nfsd), from svc_process() through nlm4svc_proc_* handlers into nlm4svc_lookup_file() and nlm_lookup_file().
AC:L - An NFS client can reliably trigger this by sending NLMv4 LOCK/TEST/SHARE/etc. with a file handle shorter than 32 bytes; stale tail bytes come from the same worker's prior RPC argument buffer, which the attacker can influence with earlier requests.
PR:N - lockd_authenticate() accepts RPC_AUTH_NULL/RPC_AUTH_UNIX and, for normal procedures, svc_set_client(); no local UID, capabilities, or root in the host namespace is required—only network reachability as an NFS export client (AUTH_NULL is explicitly supported for NLM).
UI:N - Exploitation requires only crafted NLMv4 RPC traffic to a running lockd/nfsd instance; no victim mount, file open, or other interactive action beyond normal NFS client participation.
S:U - Impact is confined to the NFS server's kernel lockd/nfsd authority (file-lock and DOS-share state on exported files); it does not cross VM, container, or IOMMU security boundaries.
C:H - file_hash() sums the first 32 bytes of nfs_fh.data regardless of fh.size; when fh.len<32, bytes fh.len..31 are stale prior-request buffer contents, so each lookup performs an out-of-bounds read of up to 31 bytes used in security-relevant file-table indexing.
I:H - Inconsistent hashing creates duplicate nlm_file entries for the same wire handle; per-entry f_shares and nlm_block state diverge while both open the same inode, enabling DOS share-mode bypass and incorrect lock/block bookkeeping despite VFS-level enforcement.
A:H - Missed nlm_file lookups cause lock-state lookup failures, incorrect NLM responses, hung or failing NFS lock clients, and unbounded duplicate nlm_file/VFS opens that can exhaust server lock-manager resources on production NFS file servers.
CVSS 3.1