CVE-2023-54269

A flaw was addressed in the Linux kernel’s SUNRPC implementation affecting deferred RPC request handling. When an RPC request is deferred, the internal rq_xprt_ctxt pointer is moved from the active service request to a deferred request structure. Under certain rare conditions where a request is deferred multiple times, the old context pointer is not cleared before reuse. This can lead to the context being freed twice while still referenced, causing memory corruption and likely resulting in a kernel oops/crash

A moderate severity flaw was found in the Linux kernel SUNRPC implementation used in Red Hat Enterprise Linux 8 and 9. When an RPC request is deferred, the rq_xprt_ctxt pointer is moved from the svc_rqst structure into a svc_deferred_req structure. If the same request is deferred a second time, the pointer is not cleared from the reused deferred-request structure, so the transport context can be released while still referenced and subsequently freed again. Successful exploitation requires an attacker with network access to a system running an affected NFSD service to trigger the rare condition of repeated deferrals of the same RPC request, resulting in memory corruption and a likely kernel oops, i.e. a denial of service. Red Hat rated this flaw CVSS 5.9 MODERATE (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) because triggering requires high attack complexity and the impact is limited to availability; this differs significantly from the upstream CRITICAL 9.8 score, which assumes low-complexity compromise of confidentiality, integrity, and availability that the technical evidence does not support. RHEL 7, RHEL 10, and Red Hat In-Vehicle OS are not affected because the vulnerable code is not present, and RHEL 6 is out of support scope. For the affected RHEL 8 and RHEL 9 kernel and kernel-rt z-branches the fix is deferred to a future update, leaving a residual risk of a low-probability kernel crash on systems running affected NFSD configurations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent module sunrpc from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.