Description (CNA)
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix dead ACL conflict guard in nfsd4_create nfsd4_create() steals create->cr_dpacl/cr_pacl into the local nfsd_attrs via the designated initializer, then immediately sets the source pointers to NULL. The subsequent conflict guard tests the already-nilled source fields, making it permanently dead code: if (create->cr_acl) { if (create->cr_dpacl || create->cr_pacl) /* always false */ When a client encodes both FATTR4_WORD0_ACL and FATTR4_WORD2_POSIX_{DEFAULT,ACCESS}_ACL in the same CREATE fattr bitmap, nfsd4_acl_to_attr() overwrites attrs.na_pacl/na_dpacl without releasing the originals, leaking two posix_acl slab objects per request. Repeated requests cause unbounded slab exhaustion. Fix by checking attrs.na_dpacl/na_pacl (the stolen values) instead of the nilled create->cr_dpacl/cr_pacl, matching the correct pattern already used in nfsd4_setattr().
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Linux / Linux | affected d2ca50606f5f0235d7780c1cd73b6614a5d07620 before 8371cc5c0a2cc2a71b3dcfd47ff1f7fcfc526a5e; affected d2ca50606f5f0235d7780c1cd73b6614a5d07620 before a60f25a800846ab8e5a13f8a9d05111f2aee55a7 |
| Linux / Linux | affected 7.0; unaffected 0 before 7.0; unaffected 7.1.3 through 7.1.*; unaffected 7.2 through * |
CWE
No CWE identifiers supplied.