CVE-2022-50241

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

NFSD: fix use-after-free on source server when doing inter-server copy

Use-after-free occurred when the laundromat tried to free expired

cpntf_state entry on the s2s_cp_stateids list after inter-server

copy completed. The sc_cp_list that the expired copy state was

inserted on was already freed.

When COPY completes, the Linux client normally sends LOCKU(lock_state x),

FREE_STATEID(lock_state x) and CLOSE(open_state y) to the source server.

The nfs4_put_stid call from nfsd4_free_stateid cleans up the copy state

from the s2s_cp_stateids list before freeing the lock state's stid.

However, sometimes the CLOSE was sent before the FREE_STATEID request.

When this happens, the nfsd4_close_open_stateid call from nfsd4_close

frees all lock states on its st_locks list without cleaning up the copy

state on the sc_cp_list list. When the time the FREE_STATEID arrives the

server returns BAD_STATEID since the lock state was freed.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References