In the Linux kernel, the following vulnerability has been resolved:
nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations
nfsd4_drop_revoked_stid() handles FREE_STATEID for admin-revoked
delegations but does not set SC_STATUS_FREED before releasing cl_lock.
revoke_delegation() uses this flag to detect whether FREE_STATEID has
already processed the delegation -- without it, the freed delegation is
added to cl_revoked via list_add(), producing a use-after-free when
cl_revoked is later traversed in __destroy_client().
The SC_STATUS_REVOKED path in nfsd4_free_stateid() (line 7983) already
sets SC_STATUS_FREED correctly. Apply the same pattern to the
SC_STATUS_ADMIN_REVOKED path in nfsd4_drop_revoked_stid().
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v3.1
References 4
https://git.kernel.org/stable/c/1e4795766719ffd74b8cf0f2fde4a1350f8326bf
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/650d370cfbc66a96dd14d517bd704689b5bda4e5
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/a6d89032e5c6620d5bb44582a72555ce07bf1c2e
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/d832a0587528853d45481d1faf75d4b5d062adaf
416baaa9-dc9f-4396-8d5f-8c081fb06d67