From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CEFC312CD9D for ; Fri, 24 May 2024 15:02:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1716562939; cv=none; b=n2KwMmf6h0x4Aa3sNynBw2MHLu3lmuBO7rkpwhX2u6NUMGbsfjg6mLTIVVfAVehPt5QNf5YW/QDy3zi1doG2ABWPwvQ0SYZ/s1PaY+PaHFLigAt4rc+m851Xg1sBxnBYxwLDCwYSA6RR3fVjCdQcsHU5Ss8lpY+WRtOGIix7ArA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1716562939; c=relaxed/simple; bh=LJBovTcjuzDNVOQWO88nL4QtsP/0qeaEBWciCmIarbM=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=PGD1Sp0Z7SWbbXif8+Z+44UzTxJjvKGa7MVLKeYWRN60ht/l5EpLb/ioKXFKL3vwvXNqyHXhHBWZfvVpyHy+j6Fcpc3fCG6JAUo/DhsZHqUpM97RK4mqFRbExAVj9LAadOdgalTBJfJLpvQ7e3IIbsjXXYtYDuf9egnius6QR0M= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=gwg1aEe4; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="gwg1aEe4" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 58498C2BBFC; Fri, 24 May 2024 15:02:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1716562939; bh=LJBovTcjuzDNVOQWO88nL4QtsP/0qeaEBWciCmIarbM=; h=From:To:Cc:Subject:Date:Reply-to:From; b=gwg1aEe4XMNLwJ8Yxdl8rPjXHKASm7GPo+3ywAWAoQU+LWTVTIKsTLjfcJ5Qr/Aqe h9HJ61/x6HVAk2AytPiXKnf9++/7YbJWqLJTSop7GQzm+0Y58npAXus8w+SvsmWG4t 1JzVGCi1rGUL1laxqQrqOPMvAvLyL1lcJoJydeig= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2021-47506: nfsd: fix use-after-free due to delegation race Date: Fri, 24 May 2024 17:01:55 +0200 Message-ID: <2024052452-CVE-2021-47506-c143@gregkh> X-Mailer: git-send-email 2.45.1 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=3015; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=LJBovTcjuzDNVOQWO88nL4QtsP/0qeaEBWciCmIarbM=; b=owGbwMvMwCRo6H6F97bub03G02pJDGkBqx9cYr327Tn3tYaQk68fLZB0nV05eeNJ28M36r5GT PT++6e1tyOWhUGQiUFWTJHlyzaeo/srDil6GdqehpnDygQyhIGLUwAmcoOBYcFp7+tv6ydrfZR1 zzNlb1d8uoHzwkGGBfNfpUpzrEn1u7V/6/bwfN+f9rOLnwMA X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit Description =========== In the Linux kernel, the following vulnerability has been resolved: nfsd: fix use-after-free due to delegation race A delegation break could arrive as soon as we've called vfs_setlease. A delegation break runs a callback which immediately (in nfsd4_cb_recall_prepare) adds the delegation to del_recall_lru. If we then exit nfs4_set_delegation without hashing the delegation, it will be freed as soon as the callback is done with it, without ever being removed from del_recall_lru. Symptoms show up later as use-after-free or list corruption warnings, usually in the laundromat thread. I suspect aba2072f4523 "nfsd: grant read delegations to clients holding writes" made this bug easier to hit, but I looked as far back as v3.0 and it looks to me it already had the same problem. So I'm not sure where the bug was introduced; it may have been there from the beginning. The Linux kernel CVE team has assigned CVE-2021-47506 to this issue. Affected and fixed versions =========================== Fixed in 4.4.296 with commit 04a8d07f3d58 Fixed in 4.9.294 with commit 348714018139 Fixed in 4.14.259 with commit 33645d3e2272 Fixed in 4.19.222 with commit 2becaa990b93 Fixed in 5.4.168 with commit e0759696de68 Fixed in 5.10.85 with commit eeb0711801f5 Fixed in 5.15.8 with commit 148c816f10fd Fixed in 5.16 with commit 548ec0805c39 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2021-47506 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: fs/nfsd/nfs4state.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/04a8d07f3d58308b92630045560799a3faa3ebce https://git.kernel.org/stable/c/348714018139c39533c55661a0c7c990671396b4 https://git.kernel.org/stable/c/33645d3e22720cac1e4548f8fef57bf0649536ee https://git.kernel.org/stable/c/2becaa990b93cbd2928292c0b669d3abb6cf06d4 https://git.kernel.org/stable/c/e0759696de6851d7536efddfdd2dfed4c4df1f09 https://git.kernel.org/stable/c/eeb0711801f5e19ef654371b627682aed3b11373 https://git.kernel.org/stable/c/148c816f10fd11df27ca6a9b3238cdd42fa72cd3 https://git.kernel.org/stable/c/548ec0805c399c65ed66c6641be467f717833ab5