In the Linux kernel, the following vulnerability has been resolved:
nfsd: fix stale s2s_cp_stateids IDR entry for async COPY
For an async COPY, nfsd4_copy() called nfs4_init_copy_state() before
dup_copy_fields(), so the s2s_cp_stateids IDR was pointed at
&u->copy->cp_stateid -- memory in the per-rqstp COMPOUND buffer that is
reused by the next request. dup_copy_fields() copies only the value into
async_copy, so the IDR slot dangled at the transient buffer for the whole
background copy. Any IDR walker then dereferences reused request memory:
the laundromat reads cs_type from it and, if the bytes look like an
expired NFS4_COPYNOTIFY_STID, follows into
refcount_dec()/idr_remove()/kfree() on garbage; manage_cpntf_state() has
the same exposure via idr_find().
Duplicate the fields first, then register the stateid on the stable
async_copy. result->cb_stateid is unchanged.
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8
AV:N - The dangling s2s_cp_stateids pointer is installed by nfsd4_copy in the in-kernel NFSv4.2 server; a remote client reaches it over TCP/2049 via COMPOUND RPCs (EXCHANGE_ID, CREATE_SESSION, OPEN, then async COPY).
AC:L - The attacker reliably creates the stale IDR entry with async COPY, then either reuses that nfsd thread's COMPOUND iops buffer with further requests or sends a >8-op compound so the vcalloc'd ops array is kvfree_rcu'd, and later walks the IDR via OFFLOAD_CANCEL/READ or the laundromat; no condition outside attacker control is required.
PR:N - Typical nfsd deployments use AUTH_SYS or AUTH_NULL with IP-based exports, so a remote peer that can reach the export can create an NFSv4.2 session, OPEN readable and writable files, and issue async COPY without a local account or capability on the NFS server.
UI:N - Exploitation requires only attacker-sent NFS RPCs against a running nfsd export; no victim user action such as mounting a filesystem or opening a local file on the server is required.
S:U - The stale IDR dereference corrupts kernel nfsd copy and copy-notify state on the NFS server host and does not cross a VM, IOMMU, or sandbox boundary.
C:H - The IDR retains a pointer into reused per-rqstp COMPOUND memory or a kvfree_rcu'd ops array; the laundromat and manage_cpntf_state then read cs_type and adjacent fields from attacker-controlled reused or sprayed memory, a use-after-free disclosure primitive.
I:H - When reused bytes look like an expired NFS4_COPYNOTIFY_STID, the laundromat and manage_cpntf_state perform list_del, refcount_dec, and kfree on the garbage object, a use-after-free write/free primitive that enables heap corruption and control-flow hijacking.
A:H - kfree or list_del on the dangling COMPOUND buffer or sprayed slab oopses or panics nfsd worker threads, and the attacker can repeat async COPY plus IDR walks to take down the NFS server host.
| Attack Vector |
Network |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
None |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:N - The dangling s2s_cp_stateids pointer is installed by nfsd4_copy in the in-kernel NFSv4.2 server; a remote client reaches it over TCP/2049 via COMPOUND RPCs (EXCHANGE_ID, CREATE_SESSION, OPEN, then async COPY).
AC:L - The attacker reliably creates the stale IDR entry with async COPY, then either reuses that nfsd thread's COMPOUND iops buffer with further requests or sends a >8-op compound so the vcalloc'd ops array is kvfree_rcu'd, and later walks the IDR via OFFLOAD_CANCEL/READ or the laundromat; no condition outside attacker control is required.
PR:N - Typical nfsd deployments use AUTH_SYS or AUTH_NULL with IP-based exports, so a remote peer that can reach the export can create an NFSv4.2 session, OPEN readable and writable files, and issue async COPY without a local account or capability on the NFS server.
UI:N - Exploitation requires only attacker-sent NFS RPCs against a running nfsd export; no victim user action such as mounting a filesystem or opening a local file on the server is required.
S:U - The stale IDR dereference corrupts kernel nfsd copy and copy-notify state on the NFS server host and does not cross a VM, IOMMU, or sandbox boundary.
C:H - The IDR retains a pointer into reused per-rqstp COMPOUND memory or a kvfree_rcu'd ops array; the laundromat and manage_cpntf_state then read cs_type and adjacent fields from attacker-controlled reused or sprayed memory, a use-after-free disclosure primitive.
I:H - When reused bytes look like an expired NFS4_COPYNOTIFY_STID, the laundromat and manage_cpntf_state perform list_del, refcount_dec, and kfree on the garbage object, a use-after-free write/free primitive that enables heap corruption and control-flow hijacking.
A:H - kfree or list_del on the dangling COMPOUND buffer or sprayed slab oopses or panics nfsd worker threads, and the attacker can repeat async COPY plus IDR walks to take down the NFS server host.
CVSS 3.1