In the Linux kernel, the following vulnerability has been resolved:
NFSD: Prevent client use-after-free during blocked-lock reaping
A bare lock owner -- its only remaining reference a blocked lock on
nn->blocked_locks_lru -- holds a raw pointer to its nfs4_client but
no reference keeping the client alive. When the per-net laundromat
reaps such a lock, freeing the nbl drops the owner reference
held through flc_owner, and the final nfs4_put_stateowner()
takes the client's cl_lock. Because the laundromat detaches the
nbl first, __destroy_client() no longer finds it, so a concurrent
force_expire_client() can free the client before nfs4_put_stateowner()
runs, dereferencing cl_lock in freed memory.
Pin the client with cl_rpc_users before dropping
nn->blocked_locks_lock, and skip clients already expiring, whose
blocked locks __destroy_client() frees while holding an owner
reference. Take nn->client_lock outside nn->blocked_locks_lock.
Every other site holds nn->blocked_locks_lock as a leaf, acquiring
no further lock, so placing nn->client_lock outside it cannot form
a lock-order cycle.
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8
AV:N - NFSD is the in-kernel NFS server; the UAF is reached by remote NFSv4.1 COMPOUND RPCs over TCP/UDP 2049 (EXCHANGE_ID, CREATE_SESSION, OPEN, blocking LOCK, DESTROY_SESSION, DESTROY_CLIENTID) that queue a blocked lock and expire the client while nfs4_laundromat() reaps it.
AC:L - The attacker controls both sides: one client holds a conflicting lock while another queues a FILE_LOCK_DEFERRED blocked lock (bare lockowner), then DESTROY_CLIENTID races with laundromat free_blocked_lock() after nbl detach; concurrent compounds create the race and it is retryable.
PR:N - Typical nfsd deployments use AUTH_SYS/AUTH_NULL with no cryptographic RPC authentication. A remote peer that can reach an export can create NFSv4.1 state and issue DESTROY_CLIENTID (ALLOWED_WITHOUT_FH) without a local account or kernel capabilities on the server.
UI:N - Exploitation requires only attacker-sent NFS RPCs against a running nfsd export. No victim user action such as mounting a filesystem or opening a local file on the server is required.
S:U - The use-after-free is of struct nfs4_client in the NFS server kernel and does not cross a separate security authority such as a VM, guest/host, sandbox, or IOMMU boundary.
C:H - free_blocked_lock() drops flc_owner into nfs4_put_stateowner(), which takes cl_lock on a nfs4_client already freed by concurrent expire_client(). The mergeable client_slab object (KMEM_CACHE flags 0) can be reclaimed via EXCHANGE_ID to disclose kernel memory.
I:H - nfs4_put_stateowner() does atomic_dec_and_lock on the freed client's cl_lock and so_unhash walks client-owned lists; reclaiming the nfs4_client slab enables heap corruption and control-flow hijack. Kernel guidance scores use-after-free as I:H.
A:H - Use-after-free of nfs4_client (spin_lock of freed cl_lock) in the laundromat worker oopses or panics the NFS server even without full exploitation, fully denying service of the host.
| Attack Vector |
Network |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
None |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:N - NFSD is the in-kernel NFS server; the UAF is reached by remote NFSv4.1 COMPOUND RPCs over TCP/UDP 2049 (EXCHANGE_ID, CREATE_SESSION, OPEN, blocking LOCK, DESTROY_SESSION, DESTROY_CLIENTID) that queue a blocked lock and expire the client while nfs4_laundromat() reaps it.
AC:L - The attacker controls both sides: one client holds a conflicting lock while another queues a FILE_LOCK_DEFERRED blocked lock (bare lockowner), then DESTROY_CLIENTID races with laundromat free_blocked_lock() after nbl detach; concurrent compounds create the race and it is retryable.
PR:N - Typical nfsd deployments use AUTH_SYS/AUTH_NULL with no cryptographic RPC authentication. A remote peer that can reach an export can create NFSv4.1 state and issue DESTROY_CLIENTID (ALLOWED_WITHOUT_FH) without a local account or kernel capabilities on the server.
UI:N - Exploitation requires only attacker-sent NFS RPCs against a running nfsd export. No victim user action such as mounting a filesystem or opening a local file on the server is required.
S:U - The use-after-free is of struct nfs4_client in the NFS server kernel and does not cross a separate security authority such as a VM, guest/host, sandbox, or IOMMU boundary.
C:H - free_blocked_lock() drops flc_owner into nfs4_put_stateowner(), which takes cl_lock on a nfs4_client already freed by concurrent expire_client(). The mergeable client_slab object (KMEM_CACHE flags 0) can be reclaimed via EXCHANGE_ID to disclose kernel memory.
I:H - nfs4_put_stateowner() does atomic_dec_and_lock on the freed client's cl_lock and so_unhash walks client-owned lists; reclaiming the nfs4_client slab enables heap corruption and control-flow hijack. Kernel guidance scores use-after-free as I:H.
A:H - Use-after-free of nfs4_client (spin_lock of freed cl_lock) in the laundromat worker oopses or panics the NFS server even without full exploitation, fully denying service of the host.
CVSS 3.1