In the Linux kernel, the following vulnerability has been resolved:
nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr()
The BOTH_TIME_SET branch calls fh_verify() early so setattr_prepare()
can inspect the dentry. This causes nfsd_setattr() to skip
fh_want_write(), so notify_change() runs without a mount write
reference.
Add the missing fh_want_write() call after the early fh_verify().
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v3.1
References 8
https://git.kernel.org/stable/c/15ca3b64a69caa6194bed8f98a20ed90a11c11dd
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/4e475be769aa9f7a2c1ce55a2b8592cfccacddcc
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/533964d420d385e11b08dd4c56c66ef5dcccaf08
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/c4a409b86a92815181a8e9395c6bf1696ad19175
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/2150305134889fb2fc25228d35353bd2f6f29500
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/3eec9d791968c177a4a8cda9af5c04f79dae09cb
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/9229d824b938f4fb0ea7a5dddade51735e6fe6f9
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/d823bf9285cdf4514873b85ab5a888878dd4e8f4
416baaa9-dc9f-4396-8d5f-8c081fb06d67