In the Linux kernel, the following vulnerability has been resolved:
nfsd: initialize copy-notify stateid before publishing it
nfsd4_copy_notify() finished initializing the cpntf state after
nfs4_alloc_init_cpntf_state() had already linked it into the
s2s_cp_stateids IDR and the parent's sc_cp_list, with cs_count == 1 (the
membership reference) and none held for the caller. A racing
OFFLOAD_CANCEL (crafted cl_id == nn->s2s_cp_cl_id plus the guessable
so_id) could reach manage_cpntf_state() and free the entry, turning the
caller's subsequent cpn_cnr_stateid read and cp_p_stateid/cp_p_clid
writes into use-after-free. The owning clientid was also only recorded
after publication, so it could not gate an ownership check in that window.
Record cp_p_stateid and cp_p_clid inside nfs4_alloc_init_cpntf_state()
before nfs4_init_cp_state() publishes the entry, and return it with an
extra reference. The caller reads the stateid under that reference and
drops it with nfs4_put_cpntf_state(); on a late error the laundromat
reaps the entry.
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8
AV:N - The UAF is in nfsd COPY_NOTIFY (nfsd4_copy_notify/nfs4_alloc_init_cpntf_state). NFSv4.2 COPY_NOTIFY and a racing OFFLOAD_CANCEL are processed from compounds over TCP/2049 via nfsd4_proc_compound, so a remote NFS client reaches the published cpntf object over the network.
AC:L - The attacker controls both sides: one compound publishes the cpntf IDR entry via COPY_NOTIFY while a concurrent OFFLOAD_CANCEL uses the leaked nn->s2s_cp_cl_id and a cyclic guessable so_id to kfree it before initialization finishes; the race is retryable on multiple session slots with no condition outside attacker control.
PR:N - Default AUTH_SYS/AUTH_NULL nfsd exports do no cryptographic authentication; any host allowed by the export ACL can EXCHANGE_ID/CREATE_SESSION, OPEN a readable file, and issue COPY_NOTIFY and OFFLOAD_CANCEL. No local account or capability on the NFS server is required.
UI:N - The attacking NFS client drives COPY_NOTIFY and the concurrent OFFLOAD_CANCEL on its own connections; no victim user or administrator action on the NFS server is required at attack time.
S:U - The use-after-free corrupts a kmalloc'd nfs4_cpntf_state in the host kernel's nfsd copy-notify tables. Impact stays in that kernel security authority and does not cross a VM, IOMMU, or sandbox boundary.
C:H - After OFFLOAD_CANCEL kfree's the object (cs_count was 1), nfsd4_copy_notify memcpy's the freed cp_stateid.cs_stid into the RPC reply; reclaim of that kmalloc slab lets the attacker disclose kernel memory. Per kernel guidance a use-after-free is C:H.
I:H - The same path then writes cp_p_stateid and cp_p_clid into the freed nfs4_cpntf_state, a use-after-free write primitive usable for heap corruption and control-flow hijacking. Per kernel guidance a use-after-free is I:H.
A:H - Use-after-free of nfs4_cpntf_state in an nfsd worker oopses or panics the NFS server even without full exploitation, and the attacker can repeat the concurrent RPC sequence to deny service.
| Attack Vector |
Network |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
None |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:N - The UAF is in nfsd COPY_NOTIFY (nfsd4_copy_notify/nfs4_alloc_init_cpntf_state). NFSv4.2 COPY_NOTIFY and a racing OFFLOAD_CANCEL are processed from compounds over TCP/2049 via nfsd4_proc_compound, so a remote NFS client reaches the published cpntf object over the network.
AC:L - The attacker controls both sides: one compound publishes the cpntf IDR entry via COPY_NOTIFY while a concurrent OFFLOAD_CANCEL uses the leaked nn->s2s_cp_cl_id and a cyclic guessable so_id to kfree it before initialization finishes; the race is retryable on multiple session slots with no condition outside attacker control.
PR:N - Default AUTH_SYS/AUTH_NULL nfsd exports do no cryptographic authentication; any host allowed by the export ACL can EXCHANGE_ID/CREATE_SESSION, OPEN a readable file, and issue COPY_NOTIFY and OFFLOAD_CANCEL. No local account or capability on the NFS server is required.
UI:N - The attacking NFS client drives COPY_NOTIFY and the concurrent OFFLOAD_CANCEL on its own connections; no victim user or administrator action on the NFS server is required at attack time.
S:U - The use-after-free corrupts a kmalloc'd nfs4_cpntf_state in the host kernel's nfsd copy-notify tables. Impact stays in that kernel security authority and does not cross a VM, IOMMU, or sandbox boundary.
C:H - After OFFLOAD_CANCEL kfree's the object (cs_count was 1), nfsd4_copy_notify memcpy's the freed cp_stateid.cs_stid into the RPC reply; reclaim of that kmalloc slab lets the attacker disclose kernel memory. Per kernel guidance a use-after-free is C:H.
I:H - The same path then writes cp_p_stateid and cp_p_clid into the freed nfs4_cpntf_state, a use-after-free write primitive usable for heap corruption and control-flow hijacking. Per kernel guidance a use-after-free is I:H.
A:H - Use-after-free of nfs4_cpntf_state in an nfsd worker oopses or panics the NFS server even without full exploitation, and the attacker can repeat the concurrent RPC sequence to deny service.
CVSS 3.1