CVE-2023-53606 (GCVE-0-2023-53606)
Vulnerability from cvelistv5
Published
2025-10-04 15:44
Modified
2025-10-04 15:44
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: nfsd: clean up potential nfsd_file refcount leaks in COPY codepath There are two different flavors of the nfsd4_copy struct. One is embedded in the compound and is used directly in synchronous copies. The other is dynamically allocated, refcounted and tracked in the client struture. For the embedded one, the cleanup just involves releasing any nfsd_files held on its behalf. For the async one, the cleanup is a bit more involved, and we need to dequeue it from lists, unhash it, etc. There is at least one potential refcount leak in this code now. If the kthread_create call fails, then both the src and dst nfsd_files in the original nfsd4_copy object are leaked. The cleanup in this codepath is also sort of weird. In the async copy case, we'll have up to four nfsd_file references (src and dst for both flavors of copy structure). They are both put at the end of nfsd4_do_async_copy, even though the ones held on behalf of the embedded one outlive that structure. Change it so that we always clean up the nfsd_file refs held by the embedded copy structure before nfsd4_copy returns. Rework cleanup_async_copy to handle both inter and intra copies. Eliminate nfsd4_cleanup_intra_ssc since it now becomes a no-op.
References
Impacted products
Vendor Product Version
Linux Linux Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4proc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "fd63299db8090307eae66f2aef17c8f00aafa0a9",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "b3169b6ffe036b549c296a9e71591d29a1fb3209",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "75b8c681c563ef7e85da6862354efc18d2a08b1b",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "8f565846fbe8182961498d4cbe618b15076a683b",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "6ba434cb1a8d403ea9aad1b667c3ea3ad8b3191f",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4proc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.220",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.154",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.2.*",
              "status": "unaffected",
              "version": "6.2.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.220",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.154",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: clean up potential nfsd_file refcount leaks in COPY codepath\n\nThere are two different flavors of the nfsd4_copy struct. One is\nembedded in the compound and is used directly in synchronous copies. The\nother is dynamically allocated, refcounted and tracked in the client\nstruture. For the embedded one, the cleanup just involves releasing any\nnfsd_files held on its behalf. For the async one, the cleanup is a bit\nmore involved, and we need to dequeue it from lists, unhash it, etc.\n\nThere is at least one potential refcount leak in this code now. If the\nkthread_create call fails, then both the src and dst nfsd_files in the\noriginal nfsd4_copy object are leaked.\n\nThe cleanup in this codepath is also sort of weird. In the async copy\ncase, we\u0027ll have up to four nfsd_file references (src and dst for both\nflavors of copy structure). They are both put at the end of\nnfsd4_do_async_copy, even though the ones held on behalf of the embedded\none outlive that structure.\n\nChange it so that we always clean up the nfsd_file refs held by the\nembedded copy structure before nfsd4_copy returns. Rework\ncleanup_async_copy to handle both inter and intra copies. Eliminate\nnfsd4_cleanup_intra_ssc since it now becomes a no-op."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-04T15:44:15.908Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/fd63299db8090307eae66f2aef17c8f00aafa0a9"
        },
        {
          "url": "https://git.kernel.org/stable/c/b3169b6ffe036b549c296a9e71591d29a1fb3209"
        },
        {
          "url": "https://git.kernel.org/stable/c/75b8c681c563ef7e85da6862354efc18d2a08b1b"
        },
        {
          "url": "https://git.kernel.org/stable/c/8f565846fbe8182961498d4cbe618b15076a683b"
        },
        {
          "url": "https://git.kernel.org/stable/c/6ba434cb1a8d403ea9aad1b667c3ea3ad8b3191f"
        }
      ],
      "title": "nfsd: clean up potential nfsd_file refcount leaks in COPY codepath",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53606",
    "datePublished": "2025-10-04T15:44:15.908Z",
    "dateReserved": "2025-10-04T15:40:38.480Z",
    "dateUpdated": "2025-10-04T15:44:15.908Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-53606\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-10-04T16:15:57.297\",\"lastModified\":\"2025-10-06T14:56:21.733\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnfsd: clean up potential nfsd_file refcount leaks in COPY codepath\\n\\nThere are two different flavors of the nfsd4_copy struct. One is\\nembedded in the compound and is used directly in synchronous copies. The\\nother is dynamically allocated, refcounted and tracked in the client\\nstruture. For the embedded one, the cleanup just involves releasing any\\nnfsd_files held on its behalf. For the async one, the cleanup is a bit\\nmore involved, and we need to dequeue it from lists, unhash it, etc.\\n\\nThere is at least one potential refcount leak in this code now. If the\\nkthread_create call fails, then both the src and dst nfsd_files in the\\noriginal nfsd4_copy object are leaked.\\n\\nThe cleanup in this codepath is also sort of weird. In the async copy\\ncase, we\u0027ll have up to four nfsd_file references (src and dst for both\\nflavors of copy structure). They are both put at the end of\\nnfsd4_do_async_copy, even though the ones held on behalf of the embedded\\none outlive that structure.\\n\\nChange it so that we always clean up the nfsd_file refs held by the\\nembedded copy structure before nfsd4_copy returns. Rework\\ncleanup_async_copy to handle both inter and intra copies. Eliminate\\nnfsd4_cleanup_intra_ssc since it now becomes a no-op.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/6ba434cb1a8d403ea9aad1b667c3ea3ad8b3191f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/75b8c681c563ef7e85da6862354efc18d2a08b1b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8f565846fbe8182961498d4cbe618b15076a683b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b3169b6ffe036b549c296a9e71591d29a1fb3209\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/fd63299db8090307eae66f2aef17c8f00aafa0a9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.