In the Linux kernel, the following vulnerability has been resolved:
nfsd: clean up potential nfsd_file refcount leaks in COPY codepath
There are two different flavors of the nfsd4copy struct. One is embedded in the compound and is used directly in synchronous copies. The other is dynamically allocated, refcounted and tracked in the client struture. For the embedded one, the cleanup just involves releasing any nfsdfiles held on its behalf. For the async one, the cleanup is a bit more involved, and we need to dequeue it from lists, unhash it, etc.
There is at least one potential refcount leak in this code now. If the kthreadcreate call fails, then both the src and dst nfsdfiles in the original nfsd4_copy object are leaked.
The cleanup in this codepath is also sort of weird. In the async copy case, we'll have up to four nfsdfile references (src and dst for both flavors of copy structure). They are both put at the end of nfsd4doasynccopy, even though the ones held on behalf of the embedded one outlive that structure.
Change it so that we always clean up the nfsdfile refs held by the embedded copy structure before nfsd4copy returns. Rework cleanupasynccopy to handle both inter and intra copies. Eliminate nfsd4cleanupintra_ssc since it now becomes a no-op.
[
{
"id": "CVE-2023-53606-083920e5",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "nfsd4_copy",
"file": "fs/nfsd/nfs4proc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b3169b6ffe036b549c296a9e71591d29a1fb3209",
"digest": {
"length": 1640.0,
"function_hash": "183260074039158538925257769108791552440"
},
"signature_type": "Function"
},
{
"id": "CVE-2023-53606-1a14f898",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "nfsd4_cleanup_inter_ssc",
"file": "fs/nfsd/nfs4proc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fd63299db8090307eae66f2aef17c8f00aafa0a9",
"digest": {
"length": 505.0,
"function_hash": "129907528311560639678939193571211638974"
},
"signature_type": "Function"
},
{
"id": "CVE-2023-53606-1a33125e",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "fs/nfsd/nfs4proc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b3169b6ffe036b549c296a9e71591d29a1fb3209",
"digest": {
"line_hashes": [
"33420949969194957421706689245337274009",
"271742468345543546824701030161028458542",
"277036506787991703812580334463608380560",
"23061116744003684294862317081104127061",
"164138888394629951011213618362826038608",
"37780846575359676168586768040446090335",
"300050107501846606216741391894242022803",
"83154069612383329285200812925538164495",
"140627203029963138968292412977455370604",
"239825712458983312387530786032329349480",
"11974209877055576131583189957668634149",
"308828104149666599272811067471526564202",
"252042888003046968013888948292849453827",
"212153764752006339882450960497795202107",
"199070563950099495135686143929106683965",
"2147494961770276994015227041161594374",
"238017376325476984391831195590352601340",
"42475170236137209911933404281499865503",
"44644631830003787164232630025808435153",
"128341184598702052093565472255124269095",
"204432063776078158384745553559213316277",
"103318713076088791598138003019108253455",
"217390798253402041983593992048800205176",
"241999472640670739261858850626541274042",
"317796765426903656010321945729655759554",
"204507023789079280885391249717770323353",
"11759121562938930622613816864352616682",
"226549538569566988534159541799249814286",
"181053151309399476848698875413426871328",
"148243279113863487596972256101077625208",
"252999606093963738614088103027211603579",
"117882210185164375130919590443808782428"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"id": "CVE-2023-53606-1a7470b7",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "cleanup_async_copy",
"file": "fs/nfsd/nfs4proc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b3169b6ffe036b549c296a9e71591d29a1fb3209",
"digest": {
"length": 302.0,
"function_hash": "167136893815640415225595127672673867320"
},
"signature_type": "Function"
},
{
"id": "CVE-2023-53606-200f4745",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "nfsd4_do_async_copy",
"file": "fs/nfsd/nfs4proc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fd63299db8090307eae66f2aef17c8f00aafa0a9",
"digest": {
"length": 715.0,
"function_hash": "56264226989250345652664668470695378030"
},
"signature_type": "Function"
},
{
"id": "CVE-2023-53606-3276ec4a",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "fs/nfsd/nfs4proc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6ba434cb1a8d403ea9aad1b667c3ea3ad8b3191f",
"digest": {
"line_hashes": [
"33420949969194957421706689245337274009",
"271742468345543546824701030161028458542",
"277036506787991703812580334463608380560",
"23061116744003684294862317081104127061",
"164138888394629951011213618362826038608",
"37780846575359676168586768040446090335",
"300050107501846606216741391894242022803",
"83154069612383329285200812925538164495",
"140627203029963138968292412977455370604",
"239825712458983312387530786032329349480",
"11974209877055576131583189957668634149",
"308828104149666599272811067471526564202",
"252042888003046968013888948292849453827",
"212153764752006339882450960497795202107",
"199070563950099495135686143929106683965",
"2147494961770276994015227041161594374",
"238017376325476984391831195590352601340",
"42475170236137209911933404281499865503",
"44644631830003787164232630025808435153",
"128341184598702052093565472255124269095",
"204432063776078158384745553559213316277",
"103318713076088791598138003019108253455",
"217390798253402041983593992048800205176",
"241999472640670739261858850626541274042",
"317796765426903656010321945729655759554",
"204507023789079280885391249717770323353",
"11759121562938930622613816864352616682",
"226549538569566988534159541799249814286",
"181053151309399476848698875413426871328",
"148243279113863487596972256101077625208",
"252999606093963738614088103027211603579",
"117882210185164375130919590443808782428"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"id": "CVE-2023-53606-385dae8c",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "nfsd4_copy",
"file": "fs/nfsd/nfs4proc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8f565846fbe8182961498d4cbe618b15076a683b",
"digest": {
"length": 1715.0,
"function_hash": "314711470261890778036944815670626214413"
},
"signature_type": "Function"
},
{
"id": "CVE-2023-53606-38deb601",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "nfsd4_copy",
"file": "fs/nfsd/nfs4proc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6ba434cb1a8d403ea9aad1b667c3ea3ad8b3191f",
"digest": {
"length": 1640.0,
"function_hash": "183260074039158538925257769108791552440"
},
"signature_type": "Function"
},
{
"id": "CVE-2023-53606-3e52df96",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "nfsd4_cleanup_inter_ssc",
"file": "fs/nfsd/nfs4proc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6ba434cb1a8d403ea9aad1b667c3ea3ad8b3191f",
"digest": {
"length": 505.0,
"function_hash": "129907528311560639678939193571211638974"
},
"signature_type": "Function"
},
{
"id": "CVE-2023-53606-3f5c2d28",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "nfsd4_cleanup_inter_ssc",
"file": "fs/nfsd/nfs4proc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b3169b6ffe036b549c296a9e71591d29a1fb3209",
"digest": {
"length": 505.0,
"function_hash": "129907528311560639678939193571211638974"
},
"signature_type": "Function"
},
{
"id": "CVE-2023-53606-4ad218d0",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "cleanup_async_copy",
"file": "fs/nfsd/nfs4proc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@75b8c681c563ef7e85da6862354efc18d2a08b1b",
"digest": {
"length": 302.0,
"function_hash": "167136893815640415225595127672673867320"
},
"signature_type": "Function"
},
{
"id": "CVE-2023-53606-511964ce",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "cleanup_async_copy",
"file": "fs/nfsd/nfs4proc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8f565846fbe8182961498d4cbe618b15076a683b",
"digest": {
"length": 302.0,
"function_hash": "167136893815640415225595127672673867320"
},
"signature_type": "Function"
},
{
"id": "CVE-2023-53606-51f84896",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "nfsd4_do_async_copy",
"file": "fs/nfsd/nfs4proc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b3169b6ffe036b549c296a9e71591d29a1fb3209",
"digest": {
"length": 715.0,
"function_hash": "56264226989250345652664668470695378030"
},
"signature_type": "Function"
},
{
"id": "CVE-2023-53606-55607d51",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "nfsd4_cleanup_intra_ssc",
"file": "fs/nfsd/nfs4proc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@75b8c681c563ef7e85da6862354efc18d2a08b1b",
"digest": {
"length": 101.0,
"function_hash": "131171540022544086868424748921147831000"
},
"signature_type": "Function"
},
{
"id": "CVE-2023-53606-632ccd81",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "nfsd4_cleanup_intra_ssc",
"file": "fs/nfsd/nfs4proc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b3169b6ffe036b549c296a9e71591d29a1fb3209",
"digest": {
"length": 101.0,
"function_hash": "131171540022544086868424748921147831000"
},
"signature_type": "Function"
},
{
"id": "CVE-2023-53606-6847adac",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "fs/nfsd/nfs4proc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fd63299db8090307eae66f2aef17c8f00aafa0a9",
"digest": {
"line_hashes": [
"33420949969194957421706689245337274009",
"271742468345543546824701030161028458542",
"277036506787991703812580334463608380560",
"23061116744003684294862317081104127061",
"164138888394629951011213618362826038608",
"37780846575359676168586768040446090335",
"300050107501846606216741391894242022803",
"83154069612383329285200812925538164495",
"140627203029963138968292412977455370604",
"239825712458983312387530786032329349480",
"11974209877055576131583189957668634149",
"308828104149666599272811067471526564202",
"252042888003046968013888948292849453827",
"212153764752006339882450960497795202107",
"199070563950099495135686143929106683965",
"2147494961770276994015227041161594374",
"238017376325476984391831195590352601340",
"42475170236137209911933404281499865503",
"44644631830003787164232630025808435153",
"128341184598702052093565472255124269095",
"204432063776078158384745553559213316277",
"103318713076088791598138003019108253455",
"217390798253402041983593992048800205176",
"241999472640670739261858850626541274042",
"317796765426903656010321945729655759554",
"204507023789079280885391249717770323353",
"11759121562938930622613816864352616682",
"226549538569566988534159541799249814286",
"181053151309399476848698875413426871328",
"148243279113863487596972256101077625208",
"252999606093963738614088103027211603579",
"117882210185164375130919590443808782428"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"id": "CVE-2023-53606-73900ce9",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "nfsd4_copy",
"file": "fs/nfsd/nfs4proc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fd63299db8090307eae66f2aef17c8f00aafa0a9",
"digest": {
"length": 1640.0,
"function_hash": "183260074039158538925257769108791552440"
},
"signature_type": "Function"
},
{
"id": "CVE-2023-53606-7834f73f",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "nfsd4_copy",
"file": "fs/nfsd/nfs4proc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@75b8c681c563ef7e85da6862354efc18d2a08b1b",
"digest": {
"length": 1715.0,
"function_hash": "314711470261890778036944815670626214413"
},
"signature_type": "Function"
},
{
"id": "CVE-2023-53606-78a7619d",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "nfsd4_do_async_copy",
"file": "fs/nfsd/nfs4proc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@75b8c681c563ef7e85da6862354efc18d2a08b1b",
"digest": {
"length": 715.0,
"function_hash": "56264226989250345652664668470695378030"
},
"signature_type": "Function"
},
{
"id": "CVE-2023-53606-7b020f4d",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "cleanup_async_copy",
"file": "fs/nfsd/nfs4proc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6ba434cb1a8d403ea9aad1b667c3ea3ad8b3191f",
"digest": {
"length": 302.0,
"function_hash": "167136893815640415225595127672673867320"
},
"signature_type": "Function"
},
{
"id": "CVE-2023-53606-939351dc",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "fs/nfsd/nfs4proc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8f565846fbe8182961498d4cbe618b15076a683b",
"digest": {
"line_hashes": [
"33420949969194957421706689245337274009",
"271742468345543546824701030161028458542",
"277036506787991703812580334463608380560",
"23061116744003684294862317081104127061",
"164138888394629951011213618362826038608",
"37780846575359676168586768040446090335",
"300050107501846606216741391894242022803",
"83154069612383329285200812925538164495",
"140627203029963138968292412977455370604",
"239825712458983312387530786032329349480",
"11974209877055576131583189957668634149",
"308828104149666599272811067471526564202",
"252042888003046968013888948292849453827",
"212153764752006339882450960497795202107",
"199070563950099495135686143929106683965",
"2147494961770276994015227041161594374",
"238017376325476984391831195590352601340",
"42475170236137209911933404281499865503",
"44644631830003787164232630025808435153",
"128341184598702052093565472255124269095",
"204432063776078158384745553559213316277",
"103318713076088791598138003019108253455",
"217390798253402041983593992048800205176",
"241999472640670739261858850626541274042",
"317796765426903656010321945729655759554",
"204507023789079280885391249717770323353",
"11759121562938930622613816864352616682",
"226549538569566988534159541799249814286",
"181053151309399476848698875413426871328",
"148243279113863487596972256101077625208",
"252999606093963738614088103027211603579",
"131144895922251091159867841446019211812"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"id": "CVE-2023-53606-984797ad",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "nfsd4_cleanup_intra_ssc",
"file": "fs/nfsd/nfs4proc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fd63299db8090307eae66f2aef17c8f00aafa0a9",
"digest": {
"length": 101.0,
"function_hash": "131171540022544086868424748921147831000"
},
"signature_type": "Function"
},
{
"id": "CVE-2023-53606-a2225337",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "nfsd4_do_async_copy",
"file": "fs/nfsd/nfs4proc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8f565846fbe8182961498d4cbe618b15076a683b",
"digest": {
"length": 715.0,
"function_hash": "56264226989250345652664668470695378030"
},
"signature_type": "Function"
},
{
"id": "CVE-2023-53606-c8ad5076",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "nfsd4_cleanup_intra_ssc",
"file": "fs/nfsd/nfs4proc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6ba434cb1a8d403ea9aad1b667c3ea3ad8b3191f",
"digest": {
"length": 101.0,
"function_hash": "131171540022544086868424748921147831000"
},
"signature_type": "Function"
},
{
"id": "CVE-2023-53606-cc54371c",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "nfsd4_do_async_copy",
"file": "fs/nfsd/nfs4proc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6ba434cb1a8d403ea9aad1b667c3ea3ad8b3191f",
"digest": {
"length": 715.0,
"function_hash": "56264226989250345652664668470695378030"
},
"signature_type": "Function"
},
{
"id": "CVE-2023-53606-cdecec89",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "nfsd4_cleanup_intra_ssc",
"file": "fs/nfsd/nfs4proc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8f565846fbe8182961498d4cbe618b15076a683b",
"digest": {
"length": 101.0,
"function_hash": "131171540022544086868424748921147831000"
},
"signature_type": "Function"
},
{
"id": "CVE-2023-53606-d1a0e8f1",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "cleanup_async_copy",
"file": "fs/nfsd/nfs4proc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fd63299db8090307eae66f2aef17c8f00aafa0a9",
"digest": {
"length": 302.0,
"function_hash": "167136893815640415225595127672673867320"
},
"signature_type": "Function"
},
{
"id": "CVE-2023-53606-dee2efd1",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "nfsd4_cleanup_inter_ssc",
"file": "fs/nfsd/nfs4proc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@75b8c681c563ef7e85da6862354efc18d2a08b1b",
"digest": {
"length": 505.0,
"function_hash": "129907528311560639678939193571211638974"
},
"signature_type": "Function"
},
{
"id": "CVE-2023-53606-e79f1dbc",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "fs/nfsd/nfs4proc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@75b8c681c563ef7e85da6862354efc18d2a08b1b",
"digest": {
"line_hashes": [
"33420949969194957421706689245337274009",
"271742468345543546824701030161028458542",
"277036506787991703812580334463608380560",
"23061116744003684294862317081104127061",
"164138888394629951011213618362826038608",
"37780846575359676168586768040446090335",
"300050107501846606216741391894242022803",
"83154069612383329285200812925538164495",
"140627203029963138968292412977455370604",
"239825712458983312387530786032329349480",
"11974209877055576131583189957668634149",
"308828104149666599272811067471526564202",
"252042888003046968013888948292849453827",
"212153764752006339882450960497795202107",
"199070563950099495135686143929106683965",
"2147494961770276994015227041161594374",
"238017376325476984391831195590352601340",
"42475170236137209911933404281499865503",
"44644631830003787164232630025808435153",
"128341184598702052093565472255124269095",
"204432063776078158384745553559213316277",
"103318713076088791598138003019108253455",
"217390798253402041983593992048800205176",
"241999472640670739261858850626541274042",
"317796765426903656010321945729655759554",
"204507023789079280885391249717770323353",
"11759121562938930622613816864352616682",
"226549538569566988534159541799249814286",
"181053151309399476848698875413426871328",
"148243279113863487596972256101077625208",
"252999606093963738614088103027211603579",
"131144895922251091159867841446019211812"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"id": "CVE-2023-53606-f40e1cc7",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "nfsd4_cleanup_inter_ssc",
"file": "fs/nfsd/nfs4proc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8f565846fbe8182961498d4cbe618b15076a683b",
"digest": {
"length": 505.0,
"function_hash": "129907528311560639678939193571211638974"
},
"signature_type": "Function"
}
]