cve-2023-52909
Vulnerability from cvelistv5
Published
2024-08-21 06:10
Modified
2024-11-04 14:55
Severity ?
Summary
nfsd: fix handling of cached open files in nfsd4_open codepath
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/0b3a551fa58b4da941efeb209b3770868e2eddd7Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/0b778361998d6c6356b8d2fc7ddf025fb3224654Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/45c08a752982116f3287afcd1bd9c50f4fab0c28Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/973acfdfe90c8a4e58ade97ff0653a498531ff2ePatch
Impacted products
Vendor Product Version
Linux Linux Version: 5.19
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-52909",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:03:02.157963Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T17:33:12.921Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/filecache.c",
            "fs/nfsd/filecache.h",
            "fs/nfsd/nfs4state.c",
            "fs/nfsd/trace.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "45c08a752982",
              "status": "affected",
              "version": "c20097329d2c",
              "versionType": "git"
            },
            {
              "lessThan": "0b778361998d",
              "status": "affected",
              "version": "106331a12b0f",
              "versionType": "git"
            },
            {
              "lessThan": "973acfdfe90c",
              "status": "affected",
              "version": "fb70bf124b05",
              "versionType": "git"
            },
            {
              "lessThan": "0b3a551fa58b",
              "status": "affected",
              "version": "fb70bf124b05",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/filecache.c",
            "fs/nfsd/filecache.h",
            "fs/nfsd/nfs4state.c",
            "fs/nfsd/trace.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.19"
            },
            {
              "lessThan": "5.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix handling of cached open files in nfsd4_open codepath\n\nCommit fb70bf124b05 (\"NFSD: Instantiate a struct file when creating a\nregular NFSv4 file\") added the ability to cache an open fd over a\ncompound. There are a couple of problems with the way this currently\nworks:\n\nIt\u0027s racy, as a newly-created nfsd_file can end up with its PENDING bit\ncleared while the nf is hashed, and the nf_file pointer is still zeroed\nout. Other tasks can find it in this state and they expect to see a\nvalid nf_file, and can oops if nf_file is NULL.\n\nAlso, there is no guarantee that we\u0027ll end up creating a new nfsd_file\nif one is already in the hash. If an extant entry is in the hash with a\nvalid nf_file, nfs4_get_vfs_file will clobber its nf_file pointer with\nthe value of op_file and the old nf_file will leak.\n\nFix both issues by making a new nfsd_file_acquirei_opened variant that\ntakes an optional file pointer. If one is present when this is called,\nwe\u0027ll take a new reference to it instead of trying to open the file. If\nthe nfsd_file already has a valid nf_file, we\u0027ll just ignore the\noptional file and pass the nfsd_file back as-is.\n\nAlso rework the tracepoints a bit to allow for an \"opened\" variant and\ndon\u0027t try to avoid counting acquisitions in the case where we already\nhave a cached open file."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-04T14:55:02.652Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/45c08a752982116f3287afcd1bd9c50f4fab0c28"
        },
        {
          "url": "https://git.kernel.org/stable/c/0b778361998d6c6356b8d2fc7ddf025fb3224654"
        },
        {
          "url": "https://git.kernel.org/stable/c/973acfdfe90c8a4e58ade97ff0653a498531ff2e"
        },
        {
          "url": "https://git.kernel.org/stable/c/0b3a551fa58b4da941efeb209b3770868e2eddd7"
        }
      ],
      "title": "nfsd: fix handling of cached open files in nfsd4_open codepath",
      "x_generator": {
        "engine": "bippy-9e1c9544281a"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-52909",
    "datePublished": "2024-08-21T06:10:50.303Z",
    "dateReserved": "2024-08-21T06:07:11.015Z",
    "dateUpdated": "2024-11-04T14:55:02.652Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-52909\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-08-21T07:15:06.857\",\"lastModified\":\"2024-09-12T14:52:54.573\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnfsd: fix handling of cached open files in nfsd4_open codepath\\n\\nCommit fb70bf124b05 (\\\"NFSD: Instantiate a struct file when creating a\\nregular NFSv4 file\\\") added the ability to cache an open fd over a\\ncompound. There are a couple of problems with the way this currently\\nworks:\\n\\nIt\u0027s racy, as a newly-created nfsd_file can end up with its PENDING bit\\ncleared while the nf is hashed, and the nf_file pointer is still zeroed\\nout. Other tasks can find it in this state and they expect to see a\\nvalid nf_file, and can oops if nf_file is NULL.\\n\\nAlso, there is no guarantee that we\u0027ll end up creating a new nfsd_file\\nif one is already in the hash. If an extant entry is in the hash with a\\nvalid nf_file, nfs4_get_vfs_file will clobber its nf_file pointer with\\nthe value of op_file and the old nf_file will leak.\\n\\nFix both issues by making a new nfsd_file_acquirei_opened variant that\\ntakes an optional file pointer. If one is present when this is called,\\nwe\u0027ll take a new reference to it instead of trying to open the file. If\\nthe nfsd_file already has a valid nf_file, we\u0027ll just ignore the\\noptional file and pass the nfsd_file back as-is.\\n\\nAlso rework the tracepoints a bit to allow for an \\\"opened\\\" variant and\\ndon\u0027t try to avoid counting acquisitions in the case where we already\\nhave a cached open file.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: nfsd: corrige el manejo de archivos abiertos almacenados en cach\u00e9 en la ruta de c\u00f3digo nfsd4_open el commit fb70bf124b05 (\\\"NFSD: crear una instancia de un archivo de estructura al crear un archivo NFSv4 normal\\\") agreg\u00f3 la capacidad de almacenar en cach\u00e9 un fd abierto sobre un compuesto. Hay un par de problemas con la forma en que esto funciona actualmente: Es picante, ya que un nfsd_file reci\u00e9n creado puede terminar con su bit PENDIENTE borrado mientras el nf tiene hash, y el puntero nf_file todav\u00eda est\u00e1 puesto a cero. Otras tareas pueden encontrarlo en este estado y esperan ver un nf_file v\u00e1lido, y pueden ir si nf_file es NULL. Adem\u00e1s, no hay garant\u00eda de que terminemos creando un nuevo nfsd_file si ya hay uno en el hash. Si una entrada existente est\u00e1 en el hash con un nf_file v\u00e1lido, nfs4_get_vfs_file golpear\u00e1 su puntero nf_file con el valor de op_file y el antiguo nf_file se filtrar\u00e1. Solucione ambos problemas creando una nueva variante nfsd_file_acquirei_opened que toma un puntero de archivo opcional. Si hay uno presente cuando se llama, tomaremos una nueva referencia en lugar de intentar abrir el archivo. Si el nfsd_file ya tiene un nf_file v\u00e1lido, simplemente ignoraremos el archivo opcional y devolveremos el nfsd_file tal como est\u00e1. Tambi\u00e9n vuelva a trabajar un poco los puntos de seguimiento para permitir una variante \\\"abierta\\\" y no intente evitar contar adquisiciones en el caso de que ya tengamos un archivo abierto en cach\u00e9.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":4.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.19\",\"versionEndExcluding\":\"6.1.7\",\"matchCriteriaId\":\"A3B4D9E4-9005-47B1-B0C1-FFC9874D6FF6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.2:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"FF501633-2F44-4913-A8EE-B021929F49F6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.2:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"2BDA597B-CAC1-4DF0-86F0-42E142C654E9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.2:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"725C78C9-12CE-406F-ABE8-0813A01D66E8\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0b3a551fa58b4da941efeb209b3770868e2eddd7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/0b778361998d6c6356b8d2fc7ddf025fb3224654\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/45c08a752982116f3287afcd1bd9c50f4fab0c28\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/973acfdfe90c8a4e58ade97ff0653a498531ff2e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.