Title: Linux, Description: En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:

NFSD: Aplazar la limpieza de subobjetos en las retrollamadas de liberación de exportación

svc_export_put() llama a path_put() y auth_domain_put() inmediatamente cuando la última referencia se elimina, antes del período de gracia de RCU. Los lectores de RCU en e_show() y c_show() acceden tanto a ex_path (a través de seq_path/d_path) como a ex_client -> name (a través de seq_escape) sin mantener una referencia. Si cache_clean elimina la entrada y elimina la última referencia concurrentemente, los subobjetos son liberados mientras aún están en uso, produciendo una desreferenciación de puntero NULL en d_path.

El Commit 2530766492ec ('nfsd: corregir UAF al acceder a ex_uuid o ex_stats') movió kfree de ex_uuid y ex_stats a la retrollamada call_rcu, pero dejó path_put() y auth_domain_put() ejecutándose antes del período de gracia porque ambos pueden entrar en suspensión y las retrollamadas call_rcu se ejecutan en contexto de softirq.

Reemplazar call_rcu/kfree_rcu con queue_rcu_work(), lo que aplaza la retrollamada hasta después del período de gracia de RCU y la ejecuta en contexto de proceso donde se permite la suspensión. Esto permite que path_put() y auth_domain_put() sean movidos a la retrollamada aplazada junto con las otras liberaciones de recursos. Aplicar la misma corrección a expkey_put(), que tiene el patrón idéntico con ek_path y ek_client.

Una cola de trabajo dedicada limita el alcance del vaciado de apagado solo a los elementos de trabajo de liberación de exportación de NFSD; vaciar la system_unbound_wq compartida se detendría en trabajo no relacionado de otros subsistemas. nfsd_export_shutdown() usa rcu_barrier() seguido de flush_workqueue() para asegurar que todas las retrollamadas de liberación aplazadas se completen antes de que se destruyan las cachés de exportación.

Revisado por: Jeff Layton <[email protected]>

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/nfsd/export.c","fs/nfsd/export.h","fs/nfsd/nfsctl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"c224edca7af028828e2ad866b61d731b5e72b46d","lessThan":"2829e80d29b627886d12b5ea40856d56b516e67d","versionType":"git","status":"affected"},{"version":"c224edca7af028828e2ad866b61d731b5e72b46d","lessThan":"f5ab1bec5fa18731e0b1b1e60c9a68667ac73ea2","versionType":"git","status":"affected"},{"version":"c224edca7af028828e2ad866b61d731b5e72b46d","lessThan":"48db892356d6cb80f6942885545de4a6dd8d2a29","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/nfsd/export.c","fs/nfsd/export.h","fs/nfsd/nfsctl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.14","status":"affected"},{"version":"0","lessThan":"6.14","versionType":"semver","status":"unaffected"},{"version":"6.18.20","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"6.19.10","lessThanOrEqual":"6.19.*","versionType":"semver","status":"unaffected"},{"version":"7.0","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]

CWE-476

OR
          *cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*
          *cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*
          *cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*
          *cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*
          *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 6.19.10
          *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.14 up to (excluding) 6.18.20

kernel.org: https://git.kernel.org/stable/c/2829e80d29b627886d12b5ea40856d56b516e67d Types: Patch

kernel.org: https://git.kernel.org/stable/c/48db892356d6cb80f6942885545de4a6dd8d2a29 Types: Patch

kernel.org: https://git.kernel.org/stable/c/f5ab1bec5fa18731e0b1b1e60c9a68667ac73ea2 Types: Patch

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

In the Linux kernel, the following vulnerability has been resolved:

NFSD: Defer sub-object cleanup in export put callbacks

svc_export_put() calls path_put() and auth_domain_put() immediately
when the last reference drops, before the RCU grace period. RCU
readers in e_show() and c_show() access both ex_path (via
seq_path/d_path) and ex_client->name (via seq_escape) without
holding a reference. If cache_clean removes the entry and drops the
last reference concurrently, the sub-objects are freed while still
in use, producing a NULL pointer dereference in d_path.

Commit 2530766492ec ("nfsd: fix UAF when access ex_uuid or
ex_stats") moved kfree of ex_uuid and ex_stats into the
call_rcu callback, but left path_put() and auth_domain_put() running
before the grace period because both may sleep and call_rcu
callbacks execute in softirq context.

Replace call_rcu/kfree_rcu with queue_rcu_work(), which defers the
callback until after the RCU grace period and executes it in process
context where sleeping is permitted. This allows path_put() and
auth_domain_put() to be moved into the deferred callback alongside
the other resource releases. Apply the same fix to expkey_put(),
which has the identical pattern with ek_path and ek_client.

A dedicated workqueue scopes the shutdown drain to only NFSD
export release work items; flushing the shared
system_unbound_wq would stall on unrelated work from other
subsystems. nfsd_export_shutdown() uses rcu_barrier() followed
by flush_workqueue() to ensure all deferred release callbacks
complete before the export caches are destroyed.

Reviwed-by: Jeff Layton <[email protected]>

https://git.kernel.org/stable/c/2829e80d29b627886d12b5ea40856d56b516e67d

https://git.kernel.org/stable/c/48db892356d6cb80f6942885545de4a6dd8d2a29

https://git.kernel.org/stable/c/f5ab1bec5fa18731e0b1b1e60c9a68667ac73ea2