Description (CNA)
In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir Normal client creation goes through rpc_setup_pipedir(), which records clnt->pipefs_sb, but the mount-event path in __rpc_clnt_handle_event() calls rpc_setup_pipedir_sb() directly and never refreshes that field. The umount path also removes the directory without clearing clnt->pipefs_sb. After a late pipefs mount or any remount, rpc_clnt_remove_pipedir() compares the current superblock against a stale pipefs_sb pointer and skips cleanup, leaving pipefs dentries whose inode private data still points at a freed rpc_clnt, leading to a potential use-after-free during subsequent rpc_info_open() or rpc_show_info() calls. Fix this by properly updating clnt->pipefs_sb upon mount events and clearing it during unmount or failure paths.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Linux / Linux | affected cc2e7ebbeb1d0601f7f3c8d93b78fcc03a95e44a before f99fedfd1dbffe8d20b421c9a7d4655a135d4fcd; affected bfca5fb4e97c46503ddfc582335917b0cc228264 before 59527bbfb1eabdb28e95e7c725886cc2c2899cb3; affected bfca5fb4e97c46503ddfc582335917b0cc228264 before e769fcde3cc73e847b1eb3acd40c04a291cb0c0c; affected bfca5fb4e97c46503ddfc582335917b0cc228264 before cdf7a233cb94774b0e7df42d9157077983f5022c; affected bfca5fb4e97c46503ddfc582335917b0cc228264 before 932a8cf6abb2b2f8677b79153a823108d8861fe2; affected 17866066b8ac1cc38fb449670bc15dc9fee4b40a; affected 7d61d1da2ed1f682c41cae0c8d4719cdaccee5c5; affected dedf2a0eb9448ae73b270743e6ea9b108189df46; affected 194454afa6aa9d6ed74f0c57127bc8beb27c20df; affected 7749fd2dbef72a52b5c9ffdbf877691950ed4680; affected 1cdb52ffd6600a37bd355d8dce58ecd03e55e618; affected 6.6.3 before 6.6.160; affected 4.19.318 before 4.20; affected 5.4.280 before 5.5; affected 5.10.202 before 5.11; affected 5.15.140 before 5.16; affected 6.1.64 before 6.2; affected 6.5.13 before 6.6 |
| Linux / Linux | affected 6.7; unaffected 0 before 6.7; unaffected 6.6.160 through 6.6.*; unaffected 6.12.111 through 6.12.*; unaffected 6.18.50 through 6.18.*; unaffected 7.2.4 through 7.2.*; unaffected 7.3 through * |
CWE
No CWE identifiers supplied.
References
- https://git.kernel.org/stable/c/f99fedfd1dbffe8d20b421c9a7d4655a135d4fcd
- https://git.kernel.org/stable/c/59527bbfb1eabdb28e95e7c725886cc2c2899cb3
- https://git.kernel.org/stable/c/e769fcde3cc73e847b1eb3acd40c04a291cb0c0c
- https://git.kernel.org/stable/c/cdf7a233cb94774b0e7df42d9157077983f5022c
- https://git.kernel.org/stable/c/932a8cf6abb2b2f8677b79153a823108d8861fe2