In the Linux kernel, the following vulnerability has been resolved:
NFSv4.0: Fix a use-after-free problem in the asynchronous open()
Yang Erkun reports that when two threads are opening files at the same time, and are forced to abort before a reply is seen, then the call to nfsreleaseseqid() in nfs4opendatafree() can result in a use-after-free of the pointer to the defunct rpc task of the other thread. The fix is to ensure that if the RPC call is aborted before the call to nfswaitonsequence() is complete, then we must call nfsreleaseseqid() in nfs4openrelease() before the rpctask is freed.
[
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"330142276836836795345769957796278128620",
"320711172544957593618673953354083307770",
"153785039116080956429010995246137667343",
"84822260662711810727439705718591340562",
"84132568091843607100028528369541491840",
"274554938158513268281635692520133219446",
"275982840164043780103083544772878339368"
]
},
"id": "CVE-2024-53173-3d0c47c0",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b56ae8e715557b4fc227c9381d2e681ffafe7b15",
"target": {
"file": "fs/nfs/nfs4proc.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"330142276836836795345769957796278128620",
"320711172544957593618673953354083307770",
"153785039116080956429010995246137667343",
"84822260662711810727439705718591340562",
"84132568091843607100028528369541491840",
"274554938158513268281635692520133219446",
"275982840164043780103083544772878339368"
]
},
"id": "CVE-2024-53173-3ec46880",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2fdb05dc0931250574f0cb0ebeb5ed8e20f4a889",
"target": {
"file": "fs/nfs/nfs4proc.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 390.0,
"function_hash": "332527290835105829069545229735118777096"
},
"id": "CVE-2024-53173-6427ebef",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2ab9639f16b05d948066a6c4cf19a0fdc61046ff",
"target": {
"file": "fs/nfs/nfs4proc.c",
"function": "nfs4_open_release"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"330142276836836795345769957796278128620",
"320711172544957593618673953354083307770",
"153785039116080956429010995246137667343",
"84822260662711810727439705718591340562",
"84132568091843607100028528369541491840",
"274554938158513268281635692520133219446",
"275982840164043780103083544772878339368"
]
},
"id": "CVE-2024-53173-65962767",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@229a30ed42bb87bcb044c5523fabd9e4f0e75648",
"target": {
"file": "fs/nfs/nfs4proc.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 390.0,
"function_hash": "332527290835105829069545229735118777096"
},
"id": "CVE-2024-53173-6ec9a37e",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b56ae8e715557b4fc227c9381d2e681ffafe7b15",
"target": {
"file": "fs/nfs/nfs4proc.c",
"function": "nfs4_open_release"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 390.0,
"function_hash": "332527290835105829069545229735118777096"
},
"id": "CVE-2024-53173-794aa789",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ba6e6c04f60fe52d91520ac4d749d372d4c74521",
"target": {
"file": "fs/nfs/nfs4proc.c",
"function": "nfs4_open_release"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 390.0,
"function_hash": "332527290835105829069545229735118777096"
},
"id": "CVE-2024-53173-86cdac51",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2fdb05dc0931250574f0cb0ebeb5ed8e20f4a889",
"target": {
"file": "fs/nfs/nfs4proc.c",
"function": "nfs4_open_release"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"330142276836836795345769957796278128620",
"320711172544957593618673953354083307770",
"153785039116080956429010995246137667343",
"84822260662711810727439705718591340562",
"84132568091843607100028528369541491840",
"274554938158513268281635692520133219446",
"275982840164043780103083544772878339368"
]
},
"id": "CVE-2024-53173-b75873e9",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2ab9639f16b05d948066a6c4cf19a0fdc61046ff",
"target": {
"file": "fs/nfs/nfs4proc.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"330142276836836795345769957796278128620",
"320711172544957593618673953354083307770",
"153785039116080956429010995246137667343",
"84822260662711810727439705718591340562",
"84132568091843607100028528369541491840",
"274554938158513268281635692520133219446",
"275982840164043780103083544772878339368"
]
},
"id": "CVE-2024-53173-c250bd6f",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5237a297ffd374a1c4157a53543b7a69d7bbbc03",
"target": {
"file": "fs/nfs/nfs4proc.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"330142276836836795345769957796278128620",
"320711172544957593618673953354083307770",
"153785039116080956429010995246137667343",
"84822260662711810727439705718591340562",
"84132568091843607100028528369541491840",
"274554938158513268281635692520133219446",
"275982840164043780103083544772878339368"
]
},
"id": "CVE-2024-53173-c43c9fe2",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ba6e6c04f60fe52d91520ac4d749d372d4c74521",
"target": {
"file": "fs/nfs/nfs4proc.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 390.0,
"function_hash": "332527290835105829069545229735118777096"
},
"id": "CVE-2024-53173-c58eaac3",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5237a297ffd374a1c4157a53543b7a69d7bbbc03",
"target": {
"file": "fs/nfs/nfs4proc.c",
"function": "nfs4_open_release"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 390.0,
"function_hash": "332527290835105829069545229735118777096"
},
"id": "CVE-2024-53173-c656ae4d",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e2277a1d9d5cd0d625a4fd7c04fce2b53e66df77",
"target": {
"file": "fs/nfs/nfs4proc.c",
"function": "nfs4_open_release"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 390.0,
"function_hash": "332527290835105829069545229735118777096"
},
"id": "CVE-2024-53173-e5942510",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@229a30ed42bb87bcb044c5523fabd9e4f0e75648",
"target": {
"file": "fs/nfs/nfs4proc.c",
"function": "nfs4_open_release"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"330142276836836795345769957796278128620",
"320711172544957593618673953354083307770",
"153785039116080956429010995246137667343",
"84822260662711810727439705718591340562",
"84132568091843607100028528369541491840",
"274554938158513268281635692520133219446",
"275982840164043780103083544772878339368"
]
},
"id": "CVE-2024-53173-f35c60f5",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e2277a1d9d5cd0d625a4fd7c04fce2b53e66df77",
"target": {
"file": "fs/nfs/nfs4proc.c"
}
}
]