nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.12.114, 6.18.57, 7.2.4
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths nfsd_dispatch() sets rq_status_counter to an odd value once a request has been decoded, and back to an even value once it has been fully processed, forming a seq-lock like protocol with the lockless reader in nfsd_nl_rpc_status_get_dumpit(). Only the fully successful path restored the counter to even. The cache-hit (RC_REPLY), drop (RC_DROPIT / RQ_DROPME) and encode-error paths all return after the odd-valued store without ever bringing the counter back to even. Once one of those paths is taken, rq_status_counter is left odd: the next request's decode ORs in 1 (still odd) and only a subsequent successful encode restores even. While stuck odd, the dumpit reader treats the rqstp fields as stable and its retry check compares against the same unchanging odd value, so it never detects concurrent mutation. This exposes actively mutating fields (e.g. args->ops / args->opcnt during compound decode and release) to the lockless reader, which can read past the end of the 8-element inline ops array. Add a helper that advances the counter to the next even value and call it on every return path that follows the odd-valued store. The decode-error path is left untouched as it is reached before the counter is set odd.
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From bd9d6a3efa9709e653aafbeb859289feccb8e70c · fixed in 5773e00cc0f9e34983bd29ba2a607c6b14258e00; From bd9d6a3efa9709e653aafbeb859289feccb8e70c · fixed in df5500ab85df661d9e4439e4c456787181fbd5ff; From bd9d6a3efa9709e653aafbeb859289feccb8e70c · fixed in b08c30f08d57f30699d36809d92f0b683dca261f; From bd9d6a3efa9709e653aafbeb859289feccb8e70c · fixed in f6045886fe3f14f269f683d64021b004a50d0efa
- Linux Linux
6.7
- KernelLinux
From 6.7.0 · fixed in 6.12.114; From 6.13.0 · fixed in 6.18.57; From 6.19.0 · fixed in 7.2.4