| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <2025091850-CVE-2022-50401-814e@gregkh> Date: Thu, 18 Sep 2025 18:03:51 +0200 From: Greg Kroah-Hartman <gregkh@...uxfoundation.org> To: linux-cve-announce@...r.kernel.org Cc: Greg Kroah-Hartman <gregkh@...nel.org> Subject: CVE-2022-50401: nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure From: Greg Kroah-Hartman <gregkh@...nel.org> Description =========== In the Linux kernel, the following vulnerability has been resolved: nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure On error situation `clp->cl_cb_conn.cb_xprt` should not be given a reference to the xprt otherwise both client cleanup and the error handling path of the caller call to put it. Better to delay handing over the reference to a later branch. [ 72.530665] refcount_t: underflow; use-after-free. [ 72.531933] WARNING: CPU: 0 PID: 173 at lib/refcount.c:28 refcount_warn_saturate+0xcf/0x120 [ 72.533075] Modules linked in: nfsd(OE) nfsv4(OE) nfsv3(OE) nfs(OE) lockd(OE) compat_nfs_ssc(OE) nfs_acl(OE) rpcsec_gss_krb5(OE) auth_rpcgss(OE) rpcrdma(OE) dns_resolver fscache netfs grace rdma_cm iw_cm ib_cm sunrpc(OE) mlx5_ib mlx5_core mlxfw pci_hyperv_intf ib_uverbs ib_core xt_MASQUERADE nf_conntrack_netlink nft_counter xt_addrtype nft_compat br_netfilter bridge stp llc nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set overlay nf_tables nfnetlink crct10dif_pclmul crc32_pclmul ghash_clmulni_intel xfs serio_raw virtio_net virtio_blk net_failover failover fuse [last unloaded: sunrpc] [ 72.540389] CPU: 0 PID: 173 Comm: kworker/u16:5 Tainted: G OE 5.15.82-dan #1 [ 72.541511] Hardware name: Red Hat KVM/RHEL-AV, BIOS 1.16.0-3.module+el8.7.0+1084+97b81f61 04/01/2014 [ 72.542717] Workqueue: nfsd4_callbacks nfsd4_run_cb_work [nfsd] [ 72.543575] RIP: 0010:refcount_warn_saturate+0xcf/0x120 [ 72.544299] Code: 55 00 0f 0b 5d e9 01 50 98 00 80 3d 75 9e 39 08 00 0f 85 74 ff ff ff 48 c7 c7 e8 d1 60 8e c6 05 61 9e 39 08 01 e8 f6 51 55 00 <0f> 0b 5d e9 d9 4f 98 00 80 3d 4b 9e 39 08 00 0f 85 4c ff ff ff 48 [ 72.546666] RSP: 0018:ffffb3f841157cf0 EFLAGS: 00010286 [ 72.547393] RAX: 0000000000000026 RBX: ffff89ac6231d478 RCX: 0000000000000000 [ 72.548324] RDX: ffff89adb7c2c2c0 RSI: ffff89adb7c205c0 RDI: ffff89adb7c205c0 [ 72.549271] RBP: ffffb3f841157cf0 R08: 0000000000000000 R09: c0000000ffefffff [ 72.550209] R10: 0000000000000001 R11: ffffb3f841157ad0 R12: ffff89ac6231d180 [ 72.551142] R13: ffff89ac6231d478 R14: ffff89ac40c06180 R15: ffff89ac6231d4b0 [ 72.552089] FS: 0000000000000000(0000) GS:ffff89adb7c00000(0000) knlGS:0000000000000000 [ 72.553175] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 72.553934] CR2: 0000563a310506a8 CR3: 0000000109a66000 CR4: 0000000000350ef0 [ 72.554874] Call Trace: [ 72.555278] <TASK> [ 72.555614] svc_xprt_put+0xaf/0xe0 [sunrpc] [ 72.556276] nfsd4_process_cb_update.isra.11+0xb7/0x410 [nfsd] [ 72.557087] ? update_load_avg+0x82/0x610 [ 72.557652] ? cpuacct_charge+0x60/0x70 [ 72.558212] ? dequeue_entity+0xdb/0x3e0 [ 72.558765] ? queued_spin_unlock+0x9/0x20 [ 72.559358] nfsd4_run_cb_work+0xfc/0x270 [nfsd] [ 72.560031] process_one_work+0x1df/0x390 [ 72.560600] worker_thread+0x37/0x3b0 [ 72.561644] ? process_one_work+0x390/0x390 [ 72.562247] kthread+0x12f/0x150 [ 72.562710] ? set_kthread_struct+0x50/0x50 [ 72.563309] ret_from_fork+0x22/0x30 [ 72.563818] </TASK> [ 72.564189] ---[ end trace 031117b1c72ec616 ]--- [ 72.566019] list_add corruption. next->prev should be prev (ffff89ac4977e538), but was ffff89ac4763e018. (next=ffff89ac4763e018). [ 72.567647] ------------[ cut here ]------------ The Linux kernel CVE team has assigned CVE-2022-50401 to this issue. Affected and fixed versions =========================== Issue introduced in 4.9.229 with commit 69151594c72a1748cf93ae5b5fa68d5084253dce and fixed in 4.9.337 with commit 707bcca9616002d204091ca7c4d1d91151104332 Issue introduced in 4.14.186 with commit 0c4fb76c4e711d9e4e70ddc6732310a17076175d and fixed in 4.14.303 with commit 15fc60aa5bdcf6d5f93000d3d00579fc67632ee0 Issue introduced in 4.19.130 with commit 22c721560ef24003bcb9c3d9c358841dcfa4e212 and fixed in 4.19.270 with commit 9b4ae8c42d2ff09ed7c5832ccce5684c55e5ed23 Issue introduced in 5.4.49 with commit e8cac2e3067e8587f8271c2177cc5ca924a61b54 and fixed in 5.4.229 with commit fddac3b4578d302ac9e51e7f03a9aae6254ae2a3 Issue introduced in 5.8 with commit a4abc6b12eb1f7a533c2e7484cfa555454ff0977 and fixed in 5.10.163 with commit c1207219a4bfa50121c9345d5d165470d0a82531 Issue introduced in 5.8 with commit a4abc6b12eb1f7a533c2e7484cfa555454ff0977 and fixed in 5.15.86 with commit a472f069ced8601979f53c13c0cf20236074ed46 Issue introduced in 5.8 with commit a4abc6b12eb1f7a533c2e7484cfa555454ff0977 and fixed in 6.0.16 with commit e2f9f03e4537f3fcc8fd2bdd3248530c3477a371 Issue introduced in 5.8 with commit a4abc6b12eb1f7a533c2e7484cfa555454ff0977 and fixed in 6.1.2 with commit d843ebd860c58a38e45527e8ec6516059f4c97f3 Issue introduced in 5.8 with commit a4abc6b12eb1f7a533c2e7484cfa555454ff0977 and fixed in 6.2 with commit 3bc8edc98bd43540dbe648e4ef91f443d6d20a24 Issue introduced in 4.4.229 with commit f5a50e848e4509448b8b91536b5d421722bf154b Issue introduced in 5.7.6 with commit c745f9ef3c8cbae70556131eaeaf0f64510243b7 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2022-50401 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: fs/nfsd/nfs4callback.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/707bcca9616002d204091ca7c4d1d91151104332 https://git.kernel.org/stable/c/15fc60aa5bdcf6d5f93000d3d00579fc67632ee0 https://git.kernel.org/stable/c/9b4ae8c42d2ff09ed7c5832ccce5684c55e5ed23 https://git.kernel.org/stable/c/fddac3b4578d302ac9e51e7f03a9aae6254ae2a3 https://git.kernel.org/stable/c/c1207219a4bfa50121c9345d5d165470d0a82531 https://git.kernel.org/stable/c/a472f069ced8601979f53c13c0cf20236074ed46 https://git.kernel.org/stable/c/e2f9f03e4537f3fcc8fd2bdd3248530c3477a371 https://git.kernel.org/stable/c/d843ebd860c58a38e45527e8ec6516059f4c97f3 https://git.kernel.org/stable/c/3bc8edc98bd43540dbe648e4ef91f443d6d20a24
Powered by blists - more mailing lists