Executive brief
A vulnerability exists in the Linux kernel's Network File System (NFS) server component. Under certain error conditions, the system may attempt to access an invalid memory address (a NULL pointer), which can lead to a system crash or service outage. This affects the availability of file-sharing services provided by the server.
Technical details
A NULL pointer dereference vulnerability exists in the nfsd component of the Linux kernel, specifically within the nfs3svc_encode_getaclres function in fs/nfsd/nfs3acl.c. The issue occurs because the code attempts to initialize a local inode variable using d_inode(dentry) before verifying if the dentry is valid. In certain error scenarios, the dentry may be NULL, leading to a kernel oops and subsequent denial of service. The fix involves deferring the inode initialization until after the response status has been verified as successful (nfs_ok). This vulnerability was introduced during a rewrite of the NFSv3 GETACL result encoder.
Affected products
- Linux Linux kernel 5.13 to 5.13.4
Timeline
- 2021-07-01: patched: Initial fix committed to Linux kernel source
- 2024-05-21: advisory: CVE published by kernel.org
References
- https://git.kernel.org/stable/c/650e6f383a6eb40f7c0a010982a74ab4b6893870
- https://git.kernel.org/stable/c/ab1016d39cc052064e32f25ad18ef8767a0ee3b8
- https://git.kernel.org/stable/c/e79057d15d96ef19de4de6d7e479bae3d58a2a8d
- https://cert-portal.siemens.com/productcert/html/ssa-265688.html
- https://cert-portal.siemens.com/productcert/html/ssa-355557.html