Description (CNA)
In the Linux kernel, the following vulnerability has been resolved: NFS: Fix a race when updating an existing write After nfs_lock_and_join_requests() tests for whether the request is still attached to the mapping, nothing prevents a call to nfs_inode_remove_request() from succeeding until we actually lock the page group. The reason is that whoever called nfs_inode_remove_request() doesn't necessarily have a lock on the page group head. So in order to avoid races, let's take the page group lock earlier in nfs_lock_and_join_requests(), and hold it across the removal of the request in nfs_inode_remove_request().
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Linux / Linux | affected bd37d6fce184836bd5e7cd90ce40116a4fadaf2a before 0ff42a32784e0f2cb46a46da8e9f473538c13e1b; affected bd37d6fce184836bd5e7cd90ce40116a4fadaf2a before f230d40147cc37eb3aef4d50e2e2c06ea73d9a77; affected bd37d6fce184836bd5e7cd90ce40116a4fadaf2a before c32e3c71aaa1c1ba05da88605e2ddd493c58794f; affected bd37d6fce184836bd5e7cd90ce40116a4fadaf2a before 181feb41f0b268e6288bf9a7b984624d7fe2031d; affected bd37d6fce184836bd5e7cd90ce40116a4fadaf2a before 92278ae36935a54e65fef9f8ea8efe7e80481ace; affected bd37d6fce184836bd5e7cd90ce40116a4fadaf2a before 202a3432d21ac060629a760fff3b0a39859da3ea; affected bd37d6fce184836bd5e7cd90ce40116a4fadaf2a before 76d2e3890fb169168c73f2e4f8375c7cc24a765e |
| Linux / Linux | affected 4.14; unaffected 0 before 4.14; unaffected 5.10.242 through 5.10.*; unaffected 5.15.191 through 5.15.*; unaffected 6.1.150 through 6.1.*; unaffected 6.6.104 through 6.6.*; unaffected 6.12.44 through 6.12.*; unaffected 6.16.4 through 6.16.*; unaffected 6.17 through * |
CWE
No CWE identifiers supplied.
References
- https://git.kernel.org/stable/c/0ff42a32784e0f2cb46a46da8e9f473538c13e1b
- https://git.kernel.org/stable/c/f230d40147cc37eb3aef4d50e2e2c06ea73d9a77
- https://git.kernel.org/stable/c/c32e3c71aaa1c1ba05da88605e2ddd493c58794f
- https://git.kernel.org/stable/c/181feb41f0b268e6288bf9a7b984624d7fe2031d
- https://git.kernel.org/stable/c/92278ae36935a54e65fef9f8ea8efe7e80481ace
- https://git.kernel.org/stable/c/202a3432d21ac060629a760fff3b0a39859da3ea
- https://git.kernel.org/stable/c/76d2e3890fb169168c73f2e4f8375c7cc24a765e
ADP enrichment
No English description supplied.
No English description supplied.
No English description supplied.
No references supplied.