In the Linux kernel, the following vulnerability has been resolved:
NFSD: Handle layout stid in nfsd4_drop_revoked_stid()
nfsd4_drop_revoked_stid() has no SC_TYPE_LAYOUT case, so when a
client sends FREE_STATEID for an admin-revoked layout stid, the
default branch releases cl_lock and returns without unhashing or
releasing the stid. The stid remains in the IDR and on the
per-client list until the client is destroyed. Remove the layout stid from the per-client list and call
nfs4_put_stid() to drop the creation reference.
When the
refcount reaches zero, nfsd4_free_layout_stateid() handles the
remaining cleanup: cancelling the fence worker, removing from
the per-file list, and freeing the slab object.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
None
No data modification
Availability
High
Complete denial of service
CVSS Vector v3.1
References 4
https://git.kernel.org/stable/c/7ed62f7040ee182cf7dea5798f9e114235b31dae
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/8024028ef91616cf91cc669f2446a0406bc0ba19
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/86b9898920a6d02b4149f4fef9efd77b8aa3b9ca
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/da6f86ff4f2dd490bea52419a49e19680efd5847
416baaa9-dc9f-4396-8d5f-8c081fb06d67