In the Linux kernel, the following vulnerability has been resolved:
nfsd: fix nfsd_file leak on inter-server COPY setup failure
When nfsd4_setup_inter_ssc() fails, nfsd4_copy() returns
nfserr_offload_denied directly, bypassing the out: label where
release_copy_files() would drop the nf_dst reference taken by
nfs4_preprocess_stateid_op(). Each failed inter-server COPY
leaks one nfsd_file, pinning file/inode/dentry/vfsmount.
Fix by setting status and jumping to out: instead of returning
directly.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
None
No data modification
Availability
High
Complete denial of service
CVSS Vector v3.1
References 4
https://git.kernel.org/stable/c/1a6a41b848455bf6ba2c9da2dfb0730e608ce7ab
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/424d5c95108a4809b832cb0a312c61de4aec0078
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/6ed8d6de7ec90c4ba84eb82673058f506e5777fd
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/88a76145451d703eedd867b5989bf73d17340399
416baaa9-dc9f-4396-8d5f-8c081fb06d67