linux-cve-announce - CVE-2023-53360: NFSv4.2: Rework scratch handling for READ

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025091722-CVE-2023-53360-a553@gregkh>
Date: Wed, 17 Sep 2025 16:56:59 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2023-53360: NFSv4.2: Rework scratch handling for READ_PLUS (again)

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

NFSv4.2: Rework scratch handling for READ_PLUS (again)

I found that the read code might send multiple requests using the same
nfs_pgio_header, but nfs4_proc_read_setup() is only called once. This is
how we ended up occasionally double-freeing the scratch buffer, but also
means we set a NULL pointer but non-zero length to the xdr scratch
buffer. This results in an oops the first time decoding needs to copy
something to scratch, which frequently happens when decoding READ_PLUS
hole segments.

I fix this by moving scratch handling into the pageio read code. I
provide a function to allocate scratch space for decoding read replies,
and free the scratch buffer when the nfs_pgio_header is freed.

The Linux kernel CVE team has assigned CVE-2023-53360 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.4 with commit fbd2a05f29a95d5b42b294bf47e55a711424965b and fixed in 6.4.16 with commit a2f4cb206bd94b3f4a7bb05fcdce9525283b5681
	Issue introduced in 6.4 with commit fbd2a05f29a95d5b42b294bf47e55a711424965b and fixed in 6.5.3 with commit ae5d5672f1db711e91db6f52df5cb16ecd8f5692
	Issue introduced in 6.4 with commit fbd2a05f29a95d5b42b294bf47e55a711424965b and fixed in 6.6 with commit 303a78052091c81e9003915c521fdca1c7e117af

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2023-53360
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/nfs/internal.h
	fs/nfs/nfs42.h
	fs/nfs/nfs42xdr.c
	fs/nfs/nfs4proc.c
	fs/nfs/read.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/adac9f0ddd2b291c7ce41f549fdb27a13616cff5
	https://git.kernel.org/stable/c/a2f4cb206bd94b3f4a7bb05fcdce9525283b5681
	https://git.kernel.org/stable/c/ae5d5672f1db711e91db6f52df5cb16ecd8f5692
	https://git.kernel.org/stable/c/303a78052091c81e9003915c521fdca1c7e117af