NFSv4.2 Vulnerability in Linux Kernel

CVE-2023-53360

What is CVE-2023-53360?

The Linux kernel's NFSv4.2 implementation has a vulnerability due to improper handling of scratch buffers during read operations. This flaw can lead to double-free issues and null pointer dereferences, particularly affecting the decoding process of READ_PLUS which is frequently invoked in NFS operations. The error arises from the reuse of the same nfs_pgio_header for multiple read requests without adequate memory management, ultimately destabilizing the system during critical read operations. A fix has been implemented to handle scratch buffer allocation and deallocation properly within the pageio read code.

References