CVE-2023-53360
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
In the Linux kernel, NFSv4.2 has a double-free of scratch buffer in READ_PLUS. The fix moves scratch handling to pageio code, preventing double-free and oops during decoding hole segments.
Risk Assessment
Double-free can lead to system crash (oops) and potential exploitation by an attacker.
Recommendation
Apply the Linux kernel patch that moves scratch handling to pageio.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: NFSv4.2: Rework scratch handling for READ_PLUS (again) I found that the read code might send multiple requests using the same nfs_pgio_header, but nfs4_proc_read_setup() is only called once. This is how we ended up occasionally double-freeing the scratch buffer, but also means we set a NULL pointer but non-zero length to the xdr scratch buffer. This results in an oops the first time decoding needs to copy something to scratch, which frequently happens when decoding READ_PLUS hole segments. I fix this by moving scratch handling into the pageio read code. I provide a function to allocate scratch space for decoding read replies, and free the scratch buffer when the nfs_pgio_header is freed.