In the Linux kernel, the following vulnerability has been resolved:
NFSD: check truncate permission under inode lock
nfsd_setattr() checks whether a size update needs NFSD_MAY_TRUNC
before it takes inode_lock(). The comparison uses the file size sampled
by that unlocked read, but the actual ATTR_SIZE update is applied later
under inode_lock() by notify_change().
This leaves a TOCTOU window for append-only files. If a client sends a
SETATTR that does not shrink the file at the time of the unlocked
sample, a concurrent append can extend the file before nfsd_setattr()
takes inode_lock(). notify_change() then applies a real truncation
without the NFSD_MAY_TRUNC check that rejects IS_APPEND(inode). The VFS
truncate syscall paths perform their own append-only checks before
calling notify_change(), so NFSD must make this decision against the
locked size it is about to change.
Split the write-count acquisition from the truncation permission check.
Keep get_write_access() before the locked setattr work, then recheck
whether the requested size is below i_size_read(inode) after inode_lock()
has been acquired and before notify_change(ATTR_SIZE). This also avoids
the plain unlocked inode->i_size load.
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CVSS Score: 9.1
AV:N - nfsd_setattr() is reached from in-kernel nfsd NFSv2/v3 SETATTR and NFSv4 SETATTR (including ONE_STATEID) over TCP/UDP 2049, so a remote client triggers the TOCTOU without local shell access.
AC:L - The attacker drives both sides of the race by issuing concurrent SETATTR size RPCs, or racing SETATTR against O_APPEND writes they perform themselves; a non-shrinking unlocked i_size sample then becomes a real truncate under inode_lock. No victim-only layout is required.
PR:N - Default nfsd exports accept AUTH_SYS and AUTH_NULL with no cryptographic authentication, so the client asserts uid/gid. ATTR_SIZE uses fh_verify(NFSD_MAY_WRITE|NFSD_MAY_OWNER_OVERRIDE), which is satisfied by spoofing the file owner's uid.
UI:N - The attacking NFS client sends SETATTR itself. No administrator or end-user action on the server is required beyond nfsd already serving a writable export.
S:U - The skipped IS_APPEND check and the resulting notify_change(ATTR_SIZE) truncate affect only the exported filesystem in the same kernel security authority as nfsd. This is not a VM, IOMMU, or sandbox escape.
C:N - The bug only omits NFSD_MAY_TRUNC for IS_APPEND before a locked size update. It does not read kernel memory, leak pointers, or disclose file contents beyond ordinary authorized NFS access.
I:H - Winning the TOCTOU lets notify_change() apply ATTR_SIZE to an IS_APPEND inode, bypassing the append-only truncation ban that VFS truncate/ftruncate enforce, so a remote client can destroy data that chattr +a is meant to keep immutable, including concurrent log and audit appends.
A:H - Unauthorized truncation of append-only operational logs, databases, or other files that services depend on can persistently destroy that live content and deny use of it until restored, and the attacker can repeat the race at will against further files.
| Attack Vector |
Network |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
None |
| Privileges Required |
None |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:N - nfsd_setattr() is reached from in-kernel nfsd NFSv2/v3 SETATTR and NFSv4 SETATTR (including ONE_STATEID) over TCP/UDP 2049, so a remote client triggers the TOCTOU without local shell access.
AC:L - The attacker drives both sides of the race by issuing concurrent SETATTR size RPCs, or racing SETATTR against O_APPEND writes they perform themselves; a non-shrinking unlocked i_size sample then becomes a real truncate under inode_lock. No victim-only layout is required.
PR:N - Default nfsd exports accept AUTH_SYS and AUTH_NULL with no cryptographic authentication, so the client asserts uid/gid. ATTR_SIZE uses fh_verify(NFSD_MAY_WRITE|NFSD_MAY_OWNER_OVERRIDE), which is satisfied by spoofing the file owner's uid.
UI:N - The attacking NFS client sends SETATTR itself. No administrator or end-user action on the server is required beyond nfsd already serving a writable export.
S:U - The skipped IS_APPEND check and the resulting notify_change(ATTR_SIZE) truncate affect only the exported filesystem in the same kernel security authority as nfsd. This is not a VM, IOMMU, or sandbox escape.
C:N - The bug only omits NFSD_MAY_TRUNC for IS_APPEND before a locked size update. It does not read kernel memory, leak pointers, or disclose file contents beyond ordinary authorized NFS access.
I:H - Winning the TOCTOU lets notify_change() apply ATTR_SIZE to an IS_APPEND inode, bypassing the append-only truncation ban that VFS truncate/ftruncate enforce, so a remote client can destroy data that chattr +a is meant to keep immutable, including concurrent log and audit appends.
A:H - Unauthorized truncation of append-only operational logs, databases, or other files that services depend on can persistently destroy that live content and deny use of it until restored, and the attacker can repeat the race at will against further files.
CVSS 3.1