In the Linux kernel, the following vulnerability has been resolved:
NFSv4.2: Rework scratch handling for READ_PLUS (again)
I found that the read code might send multiple requests using the same nfspgioheader, but nfs4procreadsetup() is only called once. This is how we ended up occasionally double-freeing the scratch buffer, but also means we set a NULL pointer but non-zero length to the xdr scratch buffer. This results in an oops the first time decoding needs to copy something to scratch, which frequently happens when decoding READPLUS hole segments.
I fix this by moving scratch handling into the pageio read code. I provide a function to allocate scratch space for decoding read replies, and free the scratch buffer when the nfspgioheader is freed.
[
{
"signature_version": "v1",
"digest": {
"function_hash": "54813888610767913829881179870122106830",
"length": 318.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ae5d5672f1db711e91db6f52df5cb16ecd8f5692",
"target": {
"function": "nfs42_read_plus_support",
"file": "fs/nfs/nfs4proc.c"
},
"id": "CVE-2023-53360-04f207cf"
},
{
"signature_version": "v1",
"digest": {
"line_hashes": [
"27401368329335095563724755056719894254",
"335995061282629298072760557089711188652",
"42766458966916275622982985087539117849",
"304592204803772305452874158167257013187"
],
"threshold": 0.9
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ae5d5672f1db711e91db6f52df5cb16ecd8f5692",
"target": {
"file": "fs/nfs/internal.h"
},
"id": "CVE-2023-53360-06a102c1"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "53156161211847514110912610138894127813",
"length": 455.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@303a78052091c81e9003915c521fdca1c7e117af",
"target": {
"function": "nfs4_xdr_dec_read_plus",
"file": "fs/nfs/nfs42xdr.c"
},
"id": "CVE-2023-53360-07e6a12e"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "206390061163270221412694046160862766776",
"length": 429.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@adac9f0ddd2b291c7ce41f549fdb27a13616cff5",
"target": {
"function": "nfs4_read_done",
"file": "fs/nfs/nfs4proc.c"
},
"id": "CVE-2023-53360-0ccc6d12"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "206390061163270221412694046160862766776",
"length": 429.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@303a78052091c81e9003915c521fdca1c7e117af",
"target": {
"function": "nfs4_read_done",
"file": "fs/nfs/nfs4proc.c"
},
"id": "CVE-2023-53360-10724f78"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "226837353341923921436691517039758714827",
"length": 83.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@adac9f0ddd2b291c7ce41f549fdb27a13616cff5",
"target": {
"function": "nfs_readhdr_free",
"file": "fs/nfs/read.c"
},
"id": "CVE-2023-53360-10f766b3"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "176493970009439027571588425644659005848",
"length": 154.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a2f4cb206bd94b3f4a7bb05fcdce9525283b5681",
"target": {
"function": "nfs4_read_plus_scratch_free",
"file": "fs/nfs/nfs4proc.c"
},
"id": "CVE-2023-53360-1d1aa77b"
},
{
"signature_version": "v1",
"digest": {
"line_hashes": [
"27401368329335095563724755056719894254",
"335995061282629298072760557089711188652",
"42766458966916275622982985087539117849",
"304592204803772305452874158167257013187"
],
"threshold": 0.9
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@303a78052091c81e9003915c521fdca1c7e117af",
"target": {
"file": "fs/nfs/internal.h"
},
"id": "CVE-2023-53360-238c4e3b"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "176493970009439027571588425644659005848",
"length": 154.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@adac9f0ddd2b291c7ce41f549fdb27a13616cff5",
"target": {
"function": "nfs4_read_plus_scratch_free",
"file": "fs/nfs/nfs4proc.c"
},
"id": "CVE-2023-53360-24ff2b60"
},
{
"signature_version": "v1",
"digest": {
"line_hashes": [
"231728348998661287316715321032126564156",
"284102787599501563940104969160886078310",
"112060513348101231139494341848010624366",
"79268134564214589407556696258242247891"
],
"threshold": 0.9
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ae5d5672f1db711e91db6f52df5cb16ecd8f5692",
"target": {
"file": "fs/nfs/nfs42xdr.c"
},
"id": "CVE-2023-53360-264982e6"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "226837353341923921436691517039758714827",
"length": 83.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ae5d5672f1db711e91db6f52df5cb16ecd8f5692",
"target": {
"function": "nfs_readhdr_free",
"file": "fs/nfs/read.c"
},
"id": "CVE-2023-53360-26f7fa27"
},
{
"signature_version": "v1",
"digest": {
"line_hashes": [
"279114228795949666277011248271945608315",
"202894938233532616770376195723665289384",
"23631566852918623457767525708139171312",
"245944190077358477305760781476236019058",
"232340197311981904186625711345509861091",
"333950954076112844886277079393582843013",
"329105859212264219749671335457298310280"
],
"threshold": 0.9
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@303a78052091c81e9003915c521fdca1c7e117af",
"target": {
"file": "fs/nfs/read.c"
},
"id": "CVE-2023-53360-2a8f5510"
},
{
"signature_version": "v1",
"digest": {
"line_hashes": [
"231728348998661287316715321032126564156",
"284102787599501563940104969160886078310",
"112060513348101231139494341848010624366",
"79268134564214589407556696258242247891"
],
"threshold": 0.9
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@303a78052091c81e9003915c521fdca1c7e117af",
"target": {
"file": "fs/nfs/nfs42xdr.c"
},
"id": "CVE-2023-53360-4f0cd27d"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "206390061163270221412694046160862766776",
"length": 429.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ae5d5672f1db711e91db6f52df5cb16ecd8f5692",
"target": {
"function": "nfs4_read_done",
"file": "fs/nfs/nfs4proc.c"
},
"id": "CVE-2023-53360-59ae90f1"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "206390061163270221412694046160862766776",
"length": 429.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a2f4cb206bd94b3f4a7bb05fcdce9525283b5681",
"target": {
"function": "nfs4_read_done",
"file": "fs/nfs/nfs4proc.c"
},
"id": "CVE-2023-53360-5cc13241"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "176493970009439027571588425644659005848",
"length": 154.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@303a78052091c81e9003915c521fdca1c7e117af",
"target": {
"function": "nfs4_read_plus_scratch_free",
"file": "fs/nfs/nfs4proc.c"
},
"id": "CVE-2023-53360-6113bffc"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "54813888610767913829881179870122106830",
"length": 318.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@303a78052091c81e9003915c521fdca1c7e117af",
"target": {
"function": "nfs42_read_plus_support",
"file": "fs/nfs/nfs4proc.c"
},
"id": "CVE-2023-53360-634d91f4"
},
{
"signature_version": "v1",
"digest": {
"line_hashes": [
"279114228795949666277011248271945608315",
"202894938233532616770376195723665289384",
"23631566852918623457767525708139171312",
"245944190077358477305760781476236019058",
"232340197311981904186625711345509861091",
"333950954076112844886277079393582843013",
"329105859212264219749671335457298310280"
],
"threshold": 0.9
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a2f4cb206bd94b3f4a7bb05fcdce9525283b5681",
"target": {
"file": "fs/nfs/read.c"
},
"id": "CVE-2023-53360-66bb28c1"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "176493970009439027571588425644659005848",
"length": 154.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ae5d5672f1db711e91db6f52df5cb16ecd8f5692",
"target": {
"function": "nfs4_read_plus_scratch_free",
"file": "fs/nfs/nfs4proc.c"
},
"id": "CVE-2023-53360-6860a8a3"
},
{
"signature_version": "v1",
"digest": {
"line_hashes": [
"146026527762723081608588191108970597757",
"114490668728373854292451155161953330368",
"110285507987366398706265374392900220742",
"199679944098103547671132690082174389377",
"147977635676234123426192921377284471920",
"39038328065565714352464552716844099734",
"49426265177672268543180199907984949459",
"127504375666012479864990479539619340675",
"38611004714497497699050645288684195645",
"267169579508806308829603503542838069873",
"267769024805879336073956478390340989738",
"336593737488291012594482246191253012488",
"108493207793708320856514707017727705370",
"308226790655773246763091503124302323941",
"159513237928250983877178315670416715121",
"79268985716802283343046353091314788555",
"100584846029858796898987544237872318534",
"63309826401667229105414199833975547975"
],
"threshold": 0.9
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@303a78052091c81e9003915c521fdca1c7e117af",
"target": {
"file": "fs/nfs/nfs4proc.c"
},
"id": "CVE-2023-53360-69898a39"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "226837353341923921436691517039758714827",
"length": 83.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@303a78052091c81e9003915c521fdca1c7e117af",
"target": {
"function": "nfs_readhdr_free",
"file": "fs/nfs/read.c"
},
"id": "CVE-2023-53360-6bef881f"
},
{
"signature_version": "v1",
"digest": {
"line_hashes": [
"279114228795949666277011248271945608315",
"202894938233532616770376195723665289384",
"23631566852918623457767525708139171312",
"245944190077358477305760781476236019058",
"232340197311981904186625711345509861091",
"333950954076112844886277079393582843013",
"329105859212264219749671335457298310280"
],
"threshold": 0.9
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ae5d5672f1db711e91db6f52df5cb16ecd8f5692",
"target": {
"file": "fs/nfs/read.c"
},
"id": "CVE-2023-53360-703120a2"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "53156161211847514110912610138894127813",
"length": 455.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@adac9f0ddd2b291c7ce41f549fdb27a13616cff5",
"target": {
"function": "nfs4_xdr_dec_read_plus",
"file": "fs/nfs/nfs42xdr.c"
},
"id": "CVE-2023-53360-74be50ff"
},
{
"signature_version": "v1",
"digest": {
"line_hashes": [
"146026527762723081608588191108970597757",
"114490668728373854292451155161953330368",
"110285507987366398706265374392900220742",
"199679944098103547671132690082174389377",
"147977635676234123426192921377284471920",
"39038328065565714352464552716844099734",
"49426265177672268543180199907984949459",
"127504375666012479864990479539619340675",
"38611004714497497699050645288684195645",
"267169579508806308829603503542838069873",
"267769024805879336073956478390340989738",
"336593737488291012594482246191253012488",
"108493207793708320856514707017727705370",
"308226790655773246763091503124302323941",
"159513237928250983877178315670416715121",
"79268985716802283343046353091314788555",
"100584846029858796898987544237872318534",
"63309826401667229105414199833975547975"
],
"threshold": 0.9
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a2f4cb206bd94b3f4a7bb05fcdce9525283b5681",
"target": {
"file": "fs/nfs/nfs4proc.c"
},
"id": "CVE-2023-53360-7e2c39b0"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "53156161211847514110912610138894127813",
"length": 455.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a2f4cb206bd94b3f4a7bb05fcdce9525283b5681",
"target": {
"function": "nfs4_xdr_dec_read_plus",
"file": "fs/nfs/nfs42xdr.c"
},
"id": "CVE-2023-53360-81524b05"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "54813888610767913829881179870122106830",
"length": 318.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a2f4cb206bd94b3f4a7bb05fcdce9525283b5681",
"target": {
"function": "nfs42_read_plus_support",
"file": "fs/nfs/nfs4proc.c"
},
"id": "CVE-2023-53360-843f4cfc"
},
{
"signature_version": "v1",
"digest": {
"line_hashes": [
"146026527762723081608588191108970597757",
"114490668728373854292451155161953330368",
"110285507987366398706265374392900220742",
"199679944098103547671132690082174389377",
"147977635676234123426192921377284471920",
"39038328065565714352464552716844099734",
"49426265177672268543180199907984949459",
"127504375666012479864990479539619340675",
"38611004714497497699050645288684195645",
"267169579508806308829603503542838069873",
"267769024805879336073956478390340989738",
"336593737488291012594482246191253012488",
"108493207793708320856514707017727705370",
"308226790655773246763091503124302323941",
"159513237928250983877178315670416715121",
"79268985716802283343046353091314788555",
"100584846029858796898987544237872318534",
"63309826401667229105414199833975547975"
],
"threshold": 0.9
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@adac9f0ddd2b291c7ce41f549fdb27a13616cff5",
"target": {
"file": "fs/nfs/nfs4proc.c"
},
"id": "CVE-2023-53360-867ce94f"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "54813888610767913829881179870122106830",
"length": 318.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@adac9f0ddd2b291c7ce41f549fdb27a13616cff5",
"target": {
"function": "nfs42_read_plus_support",
"file": "fs/nfs/nfs4proc.c"
},
"id": "CVE-2023-53360-8d440cce"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "226837353341923921436691517039758714827",
"length": 83.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a2f4cb206bd94b3f4a7bb05fcdce9525283b5681",
"target": {
"function": "nfs_readhdr_free",
"file": "fs/nfs/read.c"
},
"id": "CVE-2023-53360-8e6e7e02"
},
{
"signature_version": "v1",
"digest": {
"line_hashes": [
"231728348998661287316715321032126564156",
"284102787599501563940104969160886078310",
"112060513348101231139494341848010624366",
"79268134564214589407556696258242247891"
],
"threshold": 0.9
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@adac9f0ddd2b291c7ce41f549fdb27a13616cff5",
"target": {
"file": "fs/nfs/nfs42xdr.c"
},
"id": "CVE-2023-53360-99c825dd"
},
{
"signature_version": "v1",
"digest": {
"line_hashes": [
"233312261810154614683181942983741928812",
"317796774382344084851221228931292002000",
"274044989872306916930658903497742203136",
"218564400095475799151291335265257424966"
],
"threshold": 0.9
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@adac9f0ddd2b291c7ce41f549fdb27a13616cff5",
"target": {
"file": "fs/nfs/internal.h"
},
"id": "CVE-2023-53360-af62ddf5"
},
{
"signature_version": "v1",
"digest": {
"line_hashes": [
"27401368329335095563724755056719894254",
"335995061282629298072760557089711188652",
"42766458966916275622982985087539117849",
"304592204803772305452874158167257013187"
],
"threshold": 0.9
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a2f4cb206bd94b3f4a7bb05fcdce9525283b5681",
"target": {
"file": "fs/nfs/internal.h"
},
"id": "CVE-2023-53360-b0857bb8"
},
{
"signature_version": "v1",
"digest": {
"line_hashes": [
"146026527762723081608588191108970597757",
"114490668728373854292451155161953330368",
"110285507987366398706265374392900220742",
"199679944098103547671132690082174389377",
"147977635676234123426192921377284471920",
"39038328065565714352464552716844099734",
"49426265177672268543180199907984949459",
"127504375666012479864990479539619340675",
"38611004714497497699050645288684195645",
"267169579508806308829603503542838069873",
"267769024805879336073956478390340989738",
"336593737488291012594482246191253012488",
"108493207793708320856514707017727705370",
"308226790655773246763091503124302323941",
"159513237928250983877178315670416715121",
"79268985716802283343046353091314788555",
"100584846029858796898987544237872318534",
"63309826401667229105414199833975547975"
],
"threshold": 0.9
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ae5d5672f1db711e91db6f52df5cb16ecd8f5692",
"target": {
"file": "fs/nfs/nfs4proc.c"
},
"id": "CVE-2023-53360-e0bde99f"
},
{
"signature_version": "v1",
"digest": {
"line_hashes": [
"279114228795949666277011248271945608315",
"202894938233532616770376195723665289384",
"23631566852918623457767525708139171312",
"275973613678442165904113263049129066206",
"232340197311981904186625711345509861091",
"333950954076112844886277079393582843013",
"49144562180261310396964779855032855086"
],
"threshold": 0.9
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@adac9f0ddd2b291c7ce41f549fdb27a13616cff5",
"target": {
"file": "fs/nfs/read.c"
},
"id": "CVE-2023-53360-e520b9f8"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "53156161211847514110912610138894127813",
"length": 455.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ae5d5672f1db711e91db6f52df5cb16ecd8f5692",
"target": {
"function": "nfs4_xdr_dec_read_plus",
"file": "fs/nfs/nfs42xdr.c"
},
"id": "CVE-2023-53360-e9beac40"
},
{
"signature_version": "v1",
"digest": {
"line_hashes": [
"231728348998661287316715321032126564156",
"284102787599501563940104969160886078310",
"112060513348101231139494341848010624366",
"79268134564214589407556696258242247891"
],
"threshold": 0.9
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a2f4cb206bd94b3f4a7bb05fcdce9525283b5681",
"target": {
"file": "fs/nfs/nfs42xdr.c"
},
"id": "CVE-2023-53360-ec3c17ab"
}
]