CVE-2023-53360

In the Linux kernel, the following vulnerability has been resolved:

NFSv4.2: Rework scratch handling for READ_PLUS (again)

I found that the read code might send multiple requests using the same nfs_pgio_header, but nfs4_proc_read_setup() is only called once. This is how we ended up occasionally double-freeing the scratch buffer, but also means we set a NULL pointer but non-zero length to the xdr scratch buffer. This results in an oops the first time decoding needs to copy something to scratch, which frequently happens when decoding READ_PLUS hole segments.

I fix this by moving scratch handling into the pageio read code. I provide a function to allocate scratch space for decoding read replies, and free the scratch buffer when the nfs_pgio_header is freed.

A flaw in the NFSv4.2 client’s READ_PLUS handling could double-free the XDR scratch buffer or pass a NULL pointer with a non-zero length, leading to kernel oops during reply decoding (hole segments). The fix moves scratch management into the page-IO read path, allocating with a fixed size and freeing only when the pgio header is released, eliminating both double-free and NULL-deref scenarios. Impact is a potential client-side DoS, possibly triggerable by a malicious or buggy NFS server. While the bug is a double-free/NULL dereference and in theory could be abused as a memory corruption issue, in practice it only manifests as a client-side crash (DoS). Exploitation for code execution is not considered realistic.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.