138 lines
7.6 KiB
JSON
138 lines
7.6 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2025-38028",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2025-04-16T04:51:23.978Z",
|
|
"datePublished": "2025-06-18T09:28:33.184Z",
|
|
"dateUpdated": "2026-08-05T11:59:03.121Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-08-05T11:59:03.121Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFS/localio: Fix a race in nfs_local_open_fh()\n\nOnce the clp->cl_uuid.lock has been dropped, another CPU could come in\nand free the struct nfsd_file that was just added. To prevent that from\nhappening, take the RCU read lock before dropping the spin lock."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"baseScore": 7.8,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:L - The vulnerable code is the NFS client LOCALIO fast path, reached by ordinary read/write/commit syscalls against a mounted NFS filesystem (nfs_generic_pg_pgios and nfs_initiate_commit both call nfs_local_open_fh). LOCALIO by definition requires the nfsd server to be on the same host, so there is no remote packet path to this code.\nAC:L - The attacker controls both sides of the race: one set of threads issues concurrent I/O to enter nfs_local_open_fh, while another forces nfs_localio_disable_client()/nfs_uuid_put() to free the cached nfsd_file (via -ENOMEM/-ENXIO/-ENOENT from __nfs_local_open_fh or -EAGAIN from nfs_local_doio). The window is repeatedly retriable at will and widened by preemption under CPU pressure.\nPR:L - Any unprivileged local user with access to files on a LOCALIO-enabled NFS mount can drive both sides purely with read/write/close syscalls; no capability check exists anywhere along nfs_generic_pg_pgios → nfs_local_open_fh. The mount itself is a deployment precondition rather than a privilege the attacker must hold.\nUI:N - The attacker triggers the race entirely from their own concurrent threads; no victim action is needed once the localio mount exists.\nS:U - The use-after-free corrupts kernel slab memory within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - If the freed nfsd_file slot is reallocated, nfs_local_open_fh returns a pointer to a different live nfsd_file whose nf_file is then used for the NFS read, disclosing the contents of an unrelated file on the exported filesystem; more generally a UAF on the slab yields an arbitrary-read primitive.\nI:H - refcount_inc_not_zero() writes into freed/reallocated memory, and the returned stale nfsd_file is used for write_iter, corrupting a different file's data as well as another object's refcount, which enables a follow-on premature free and control-flow hijack.\nA:H - Use-after-free on the nfsd_file slab causes refcount warnings, slab corruption and oops/panic, and the corrupted refcount leads to a second premature free of a live nfsd_file — a repeatable local denial of service."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"fs/nfs/localio.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "86e00412254a717ffd5d38dc5ec0ee1cce6281b3",
|
|
"lessThan": "185a2f2ddabdcf999823f61de67f86376883920d",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "86e00412254a717ffd5d38dc5ec0ee1cce6281b3",
|
|
"lessThan": "fa7ab64f1e2fdc8f2603aab8e0dd20de89cb10d9",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"fs/nfs/localio.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "6.14",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "6.14",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.14.8",
|
|
"lessThanOrEqual": "6.14.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.15",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.14",
|
|
"versionEndExcluding": "6.14.8"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.14",
|
|
"versionEndExcluding": "6.15"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/185a2f2ddabdcf999823f61de67f86376883920d"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/fa7ab64f1e2fdc8f2603aab8e0dd20de89cb10d9"
|
|
}
|
|
],
|
|
"title": "NFS/localio: Fix a race in nfs_local_open_fh()",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
}
|
|
}
|
|
} |