ACK: [SRU][N][PATCH 0/1] CVE-2024-53063

[Andrei Gherzan]

On 25/03/05 12:53pm, Bethany Jamison wrote:
> [Impact]
> 
> NFSv4.0: Fix a use-after-free problem in the asynchronous open()
> 
> When two threads are opening files at the same time, and are forced to 
> abort before a reply is seen, they call to nfs_release_seqid() in 
> nfs4_opendata_free() which can result in a use-after-free of the pointer 
> to the defunct rpc task of the other thread.
> The fix is to ensure that if the RPC call is aborted before the call to
> nfs_wait_on_sequence() is complete, then we must call nfs_release_seqid()
> in nfs4_open_release() before the rpc_task is freed.
> 
> [Fix]
> 
> Oracular: released
> Noble:	  Clean cherry-pick from linux-6.11.y
> Jammy:	  pending (5.15.0-135.146)
> Focal:	  pending (5.4.0-210.230)
> Bionic:	  fix sent to esm ML
> Xenial:	  fix sent to esm ML
> Trusty:	  not fixed as it is not a critical CVE
> 
> [Test Case]
> 
> Compile and boot tested.
> 
> [Where problems could occur]
> 
> The fix affects those who use client-side procedure declarations for NFSv4,
> and issue with this fix would be visible to the user via unexpected system
> behavior.
> 
> Trond Myklebust (1):
>   NFSv4.0: Fix a use-after-free problem in the asynchronous open()
> 
>  fs/nfs/nfs4proc.c | 8 +++++---
>  1 file changed, 5 insertions(+), 3 deletions(-)

Acked-by: Andrei Gherzan <andrei.gherzan at canonical.com>

-- 
Andrei Gherzan
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20250306/2ac971f3/attachment.sig>