CVE-2024-57927

In the Linux kernel, the following vulnerability has been resolved:

nfs: Fix oops in nfs_netfs_init_request() when copying to cache

When netfslib wants to copy some data that has just been read on behalf of nfs, it creates a new write request and calls nfs_netfs_init_request() to initialise it, but with a NULL file pointer. This causes nfs_file_open_context() to oops - however, we don't actually need the nfs context as we're only going to write to the cache.

Fix this by just returning if we aren't given a file pointer and emit a warning if the request was for something other than copy-to-cache.

Further, fix nfs_netfs_free_request() so that it doesn't try to free the context if the pointer is NULL.

This vulnerability is rated as having Moderate impact because an authenticated local attacker could trigger a kernel null pointer dereference resulting in a system crash, without any compromise to system confidentiality or integrity. Exploitation is constrained to environments where NFS filesystems are mounted with local caching enabled via netfslib. Furthermore, standard Red Hat Enterprise Linux releases are not affected because the vulnerable upstream changes were introduced in newer kernel releases not present in supported enterprise kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.