Description
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix null dereference in nfsd4_setattr for deleg timestamp attrs When a SETATTR request includes FATTR4_WORD2_TIME_DELEG_ACCESS or FATTR4_WORD2_TIME_DELEG_MODIFY in the attribute bitmap, nfsd4_setattr() sets deleg_attrs=true and calls nfs4_preprocess_stateid_op() to validate the stateid. If the client supplies the NFSv4 "one stateid" (all-0xFF bytes), check_special_stateids() returns nfs_ok without populating the output nfs4_stid pointer, because the special-stateid path in nfs4_preprocess_stateid_op() jumps to done: with s==NULL, and the "if (s)" block that would set *cstid is skipped. The local variable `st` remains NULL. Back in nfsd4_setattr(), the if (deleg_attrs) block then unconditionally dereferences st->sc_type (at offset 4 from NULL), causing a kernel oops. This is remotely triggerable by any NFSv4 client: send COMPOUND [PUTROOTFH, SETATTR(ONE_STATEID, {bmval2=FATTR4_WORD2_TIME_DELEG_ACCESS, ...})]. No authentication, delegation, or prior state is required. Fix by adding a NULL check before the dereference. A special stateid is not a delegation stateid, so the existing nfserr_bad_stateid return value is already correct; we only need to guard the pointer dereference itself.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
7e13f4f8d27dc02fb88666f603c53ca749d56f92 to < 3c5119b799a7f57db332b2c31e806de16c869f0faffected7e13f4f8d27dc02fb88666f603c53ca749d56f92 to < 3c896db123892256fd39af0ee8c2d02c63539983affected7e13f4f8d27dc02fb88666f603c53ca749d56f92 to < fe456c8c0931bb3e8a03d429920e87fd85747fbaaffected
Linux Linux
Default version status: affected
6.14affected0 to < 6.14unaffected6.18.50 to ≤ 6.18.*unaffected7.2.4 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected