NACK: [SRU][N][PATCH 0/1] CVE-2024-53173

[Koichiro Den]

On Tue, Mar 11, 2025 at 04:02:19PM GMT, Bethany Jamison wrote:
> [Impact]
> 
> NFSv4.0: Fix a use-after-free problem in the asynchronous open()
> 
> When two threads are opening files at the same time, and are forced to 
> abort before a reply is seen, they call to nfs_release_seqid() in 
> nfs4_opendata_free() which can result in a use-after-free of the pointer 
> to the defunct rpc task of the other thread.
> The fix is to ensure that if the RPC call is aborted before the call to
> nfs_wait_on_sequence() is complete, then we must call nfs_release_seqid()
> in nfs4_open_release() before the rpc_task is freed.
> 
> [Fix]
> 
> Oracular: released
> Noble:	  Clean cherry-pick from linux-6.11.y
> Jammy:	  pending (5.15.0-135.146)
> Focal:	  pending (5.4.0-210.230)
> Bionic:	  fix sent to esm ML
> Xenial:	  fix sent to esm ML
> Trusty:	  not fixed as it is not a critical CVE
> 
> This is technically a resubmitted patchset to the ML. I put the wrong CVE
> ID in the subject line - I won't mark it as a v2 because this CVE ID has not
> been seen on the ML yet though.
> 
> [Test Case]
> 
> Compile and boot tested.
> 
> [Where problems could occur]
> 
> The fix affects those who use client-side procedure declarations for NFSv4,
> and issue with this fix would be visible to the user via unexpected system
> behavior.
> 
> Trond Myklebust (1):
>   NFSv4.0: Fix a use-after-free problem in the asynchronous open()
> 
>  fs/nfs/nfs4proc.c | 8 +++++---
>  1 file changed, 5 insertions(+), 3 deletions(-)
> 

This commit was included in an upstream stable patchset (LP: #2101915),
which was submitted about 20 hours before this submission and applied to
master-next:
https://lists.ubuntu.com/archives/kernel-team/2025-March/158003.html

If this had received >=2 ACKs within 1.5 days after your submission, it
would have superseded the application via upstream stable patchset. Sadly
it didn't.

Please let me NACK this for that reason.