Upstream information
Description
In the Linux kernel, the following vulnerability has been resolved:nfsd: fix management of listener transports
Currently, when no active threads are running, a root user using nfsdctl
command can try to remove a particular listener from the list of previously
added ones, then start the server by increasing the number of threads,
it leads to the following problem:
[ 158.835354] refcount_t: addition on 0; use-after-free.
[ 158.835603] WARNING: CPU: 2 PID: 9145 at lib/refcount.c:25 refcount_warn_saturate+0x160/0x1a0
[ 158.836017] Modules linked in: rpcrdma rdma_cm iw_cm ib_cm ib_core nfsd auth_rpcgss nfs_acl lockd grace overlay isofs uinput snd_seq_dummy snd_hrtimer nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 rfkill ip_set nf_tables qrtr sunrpc vfat fat uvcvideo videobuf2_vmalloc videobuf2_memops uvc videobuf2_v4l2 videodev videobuf2_common snd_hda_codec_generic mc e1000e snd_hda_intel snd_intel_dspcfg snd_hda_codec snd_hda_core snd_hwdep snd_seq snd_seq_device snd_pcm snd_timer snd soundcore sg loop dm_multipath dm_mod nfnetlink vsock_loopback vmw_vsock_virtio_transport_common vmw_vsock_vmci_transport vmw_vmci vsock xfs libcrc32c crct10dif_ce ghash_ce vmwgfx sha2_ce sha256_arm64 sr_mod sha1_ce cdrom nvme drm_client_lib drm_ttm_helper ttm nvme_core drm_kms_helper nvme_auth drm fuse
[ 158.840093] CPU: 2 UID: 0 PID: 9145 Comm: nfsd Kdump: loaded Tainted: G B W 6.13.0-rc6+ #7
[ 158.840624] Tainted: [B]=BAD_PAGE, [W]=WARN
[ 158.840802] Hardware name: VMware, Inc. VMware20,1/VBSA, BIOS VMW201.00V.24006586.BA64.2406042154 06/04/2024
[ 158.841220] pstate: 61400005 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
[ 158.841563] pc : refcount_warn_saturate+0x160/0x1a0
[ 158.841780] lr : refcount_warn_saturate+0x160/0x1a0
[ 158.842000] sp : ffff800089be7d80
[ 158.842147] x29: ffff800089be7d80 x28: ffff00008e68c148 x27: ffff00008e68c148
[ 158.842492] x26: ffff0002e3b5c000 x25: ffff600011cd1829 x24: ffff00008653c010
[ 158.842832] x23: ffff00008653c000 x22: 1fffe00011cd1829 x21: ffff00008653c028
[ 158.843175] x20: 0000000000000002 x19: ffff00008653c010 x18: 0000000000000000
[ 158.843505] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
[ 158.843836] x14: 0000000000000000 x13: 0000000000000001 x12: ffff600050a26493
[ 158.844143] x11: 1fffe00050a26492 x10: ffff600050a26492 x9 : dfff800000000000
[ 158.844475] x8 : 00009fffaf5d9b6e x7 : ffff000285132493 x6 : 0000000000000001
[ 158.844823] x5 : ffff000285132490 x4 : ffff600050a26493 x3 : ffff8000805e72bc
[ 158.845174] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff000098588000
[ 158.845528] Call trace:
[ 158.845658] refcount_warn_saturate+0x160/0x1a0 (P)
[ 158.845894] svc_recv+0x58c/0x680 [sunrpc]
[ 158.846183] nfsd+0x1fc/0x348 [nfsd]
[ 158.846390] kthread+0x274/0x2f8
[ 158.846546] ret_from_fork+0x10/0x20
[ 158.846714] ---[ end trace 0000000000000000 ]---
nfsd_nl_listener_set_doit() would manipulate the list of transports of
server's sv_permsocks and close the specified listener but the other
list of transports (server's sp_xprts list) would not be changed leading
to the problem above.
Instead, determined if the nfsdctl is trying to remove a listener, in
which case, delete all the existing listener transports and re-create
all-but-the-removed ones.
SUSE information
Overall state of this security issue: Resolved
This issue is currently rated as having moderate severity.
National Vulnerability Database | SUSE | |
---|---|---|
Base Score | 5.5 | 4.4 |
Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H |
Attack Vector | Local | Local |
Attack Complexity | Low | Low |
Privileges Required | Low | High |
User Interaction | None | None |
Scope | Unchanged | Unchanged |
Confidentiality Impact | None | None |
Integrity Impact | None | None |
Availability Impact | High | High |
CVSSv3 Version | 3.1 | 3.1 |
SUSE | |
---|---|
Base Score | 6.7 |
Vector | CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Attack Vector | Local |
Attack Complexity | Low |
Attack Requirements | None |
Privileges Required | High |
User Interaction | None |
Vulnerable System Confidentiality Impact | None |
Vulnerable System Integrity Impact | None |
Vulnerable System Availability Impact | High |
Subsequent System Confidentiality Impact | None |
Subsequent System Integrity Impact | None |
Subsequent System Availability Impact | None |
CVSSv4 Version | 4.0 |
Note from the SUSE Security Team on the kernel-default package
SUSE will no longer fix all CVEs in the Linux Kernel anymore, but declare some bug classes as won't fix. Please refer to TID 21496 for more details.SUSE Bugzilla entry: 1241348 [RESOLVED / FIXED]
No SUSE Security Announcements cross referenced.
Status of this issue by product and package
Please note that this evaluation state might be work in progress, incomplete or outdated. Also information for service packs in the LTSS phase is only included for issues meeting the LTSS criteria. If in doubt, feel free to contact us for clarification. The updates are grouped by state of their lifecycle. SUSE product lifecycles are documented on the lifecycle page.
Product(s) | Source package | State |
---|---|---|
Products under general support and receiving all security fixes. | ||
SUSE Linux Enterprise Desktop 15 SP6 | kernel-default | Not affected |
SUSE Linux Enterprise Desktop 15 SP6 | kernel-source | Not affected |
SUSE Linux Enterprise High Performance Computing 15 SP6 | kernel-default | Not affected |
SUSE Linux Enterprise High Performance Computing 15 SP6 | kernel-source | Not affected |
SUSE Linux Enterprise High Performance Computing 15 SP6 | kernel-source-azure | Not affected |
SUSE Linux Enterprise Live Patching 15 SP6 | kernel-default | Not affected |
SUSE Linux Enterprise Live Patching 15 SP6 | kernel-source | Not affected |
SUSE Linux Enterprise Micro 5.1 | kernel-default | Not affected |
SUSE Linux Enterprise Micro 5.1 | kernel-rt | Not affected |
SUSE Linux Enterprise Micro 5.1 | kernel-source | Not affected |
SUSE Linux Enterprise Micro 5.1 | kernel-source-rt | Not affected |
SUSE Linux Enterprise Micro 5.2 | kernel-default | Not affected |
SUSE Linux Enterprise Micro 5.2 | kernel-rt | Not affected |
SUSE Linux Enterprise Micro 5.2 | kernel-source | Not affected |
SUSE Linux Enterprise Micro 5.2 | kernel-source-rt | Not affected |
SUSE Linux Enterprise Micro 5.3 | kernel-default | Not affected |
SUSE Linux Enterprise Micro 5.3 | kernel-rt | Not affected |
SUSE Linux Enterprise Micro 5.3 | kernel-source | Not affected |
SUSE Linux Enterprise Micro 5.3 | kernel-source-rt | Not affected |
SUSE Linux Enterprise Micro 5.4 | kernel-default | Not affected |
SUSE Linux Enterprise Micro 5.4 | kernel-rt | Not affected |
SUSE Linux Enterprise Micro 5.4 | kernel-source | Not affected |
SUSE Linux Enterprise Micro 5.4 | kernel-source-rt | Not affected |
SUSE Linux Enterprise Micro 5.5 | kernel-default | Not affected |
SUSE Linux Enterprise Micro 5.5 | kernel-source | Not affected |
SUSE Linux Enterprise Micro 5.5 | kernel-source-rt | Not affected |
SUSE Linux Enterprise Module for Basesystem 15 SP6 | kernel-default | Not affected |
SUSE Linux Enterprise Module for Basesystem 15 SP6 | kernel-source | Not affected |
SUSE Linux Enterprise Module for Development Tools 15 SP6 | kernel-default | Not affected |
SUSE Linux Enterprise Module for Development Tools 15 SP6 | kernel-source | Not affected |
SUSE Linux Enterprise Module for Public Cloud 15 SP6 | kernel-source-azure | Not affected |
SUSE Linux Enterprise Real Time 15 SP6 | kernel-source-rt | Not affected |
SUSE Linux Enterprise Server 15 SP6 | kernel-default | Not affected |
SUSE Linux Enterprise Server 15 SP6 | kernel-source | Not affected |
SUSE Linux Enterprise Server 15 SP6 | kernel-source-azure | Not affected |
SUSE Linux Enterprise Server for SAP Applications 15 SP6 | kernel-default | Not affected |
SUSE Linux Enterprise Server for SAP Applications 15 SP6 | kernel-source | Not affected |
SUSE Linux Enterprise Server for SAP Applications 15 SP6 | kernel-source-azure | Not affected |
SUSE Linux Enterprise Workstation Extension 15 SP6 | kernel-default | Not affected |
SUSE Linux Enterprise Workstation Extension 15 SP6 | kernel-source | Not affected |
SUSE Linux Micro 6.0 | kernel-default | Not affected |
SUSE Linux Micro 6.0 | kernel-source | Not affected |
SUSE Linux Micro 6.0 | kernel-source-rt | Not affected |
SUSE Linux Micro 6.1 | kernel-default | Not affected |
SUSE Linux Micro 6.1 | kernel-source | Not affected |
SUSE Linux Micro 6.1 | kernel-source-rt | Not affected |
SUSE Manager Proxy 4.3 | kernel-default | Not affected |
SUSE Manager Proxy 4.3 | kernel-source | Not affected |
SUSE Manager Retail Branch Server 4.3 | kernel-default | Not affected |
SUSE Manager Retail Branch Server 4.3 | kernel-source | Not affected |
SUSE Manager Server 4.3 | kernel-default | Not affected |
SUSE Manager Server 4.3 | kernel-source | Not affected |
SUSE Real Time Module 15 SP6 | kernel-source-rt | Not affected |
openSUSE Leap 15.6 | kernel-default | Not affected |
openSUSE Leap 15.6 | kernel-source | Not affected |
openSUSE Leap 15.6 | kernel-source-azure | Not affected |
openSUSE Leap 15.6 | kernel-source-rt | Not affected |
Products under Long Term Service Pack support and receiving important and critical security fixes. | ||
SUSE Linux Enterprise High Performance Computing 15 SP3 | kernel-source | Not affected |
SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS | kernel-source | Not affected |
SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS | kernel-default | Not affected |
SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS | kernel-source | Not affected |
SUSE Linux Enterprise High Performance Computing 15 SP4 | kernel-source | Not affected |
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | kernel-default | Not affected |
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | kernel-source | Not affected |
SUSE Linux Enterprise High Performance Computing 15 SP5 | kernel-source | Not affected |
SUSE Linux Enterprise High Performance Computing 15 SP5 | kernel-source-azure | Not affected |
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | kernel-default | Not affected |
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | kernel-source | Not affected |
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | kernel-default | Not affected |
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | kernel-source | Not affected |
SUSE Linux Enterprise Live Patching 12 SP5 | kernel-default | Not affected |
SUSE Linux Enterprise Live Patching 12 SP5 | kernel-source | Not affected |
SUSE Linux Enterprise Live Patching 15 SP3 | kernel-default | Not affected |
SUSE Linux Enterprise Live Patching 15 SP3 | kernel-source | Not affected |
SUSE Linux Enterprise Live Patching 15 SP4 | kernel-default | Not affected |
SUSE Linux Enterprise Live Patching 15 SP4 | kernel-source | Not affected |
SUSE Linux Enterprise Live Patching 15 SP5 | kernel-default | Not affected |
SUSE Linux Enterprise Live Patching 15 SP5 | kernel-source | Not affected |
SUSE Linux Enterprise Module for Basesystem 15 SP3 | kernel-source | Not affected |
SUSE Linux Enterprise Module for Basesystem 15 SP4 | kernel-source | Not affected |
SUSE Linux Enterprise Module for Basesystem 15 SP5 | kernel-source | Not affected |
SUSE Linux Enterprise Module for Development Tools 15 SP3 | kernel-source | Not affected |
SUSE Linux Enterprise Module for Development Tools 15 SP4 | kernel-source | Not affected |
SUSE Linux Enterprise Module for Development Tools 15 SP5 | kernel-source | Not affected |
SUSE Linux Enterprise Module for Public Cloud 15 SP5 | kernel-source-azure | Not affected |
SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME CORE | kernel-default | Not affected |
SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME CORE | kernel-source | Not affected |
SUSE Linux Enterprise Server 12 SP5 | kernel-source | Not affected |
SUSE Linux Enterprise Server 12 SP5 | kernel-source-azure | Not affected |
SUSE Linux Enterprise Server 12 SP5-LTSS | kernel-default | Not affected |
SUSE Linux Enterprise Server 12 SP5-LTSS | kernel-source | Not affected |
SUSE Linux Enterprise Server 12 SP5-LTSS | kernel-source-azure | Not affected |
SUSE Linux Enterprise Server 12 SP5-LTSS Extended Security | kernel-default | Not affected |
SUSE Linux Enterprise Server 12 SP5-LTSS Extended Security | kernel-source | Not affected |
SUSE Linux Enterprise Server 15 SP3 | kernel-source | Not affected |
SUSE Linux Enterprise Server 15 SP3-LTSS | kernel-default | Not affected |
SUSE Linux Enterprise Server 15 SP3-LTSS | kernel-source | Not affected |
SUSE Linux Enterprise Server 15 SP4 | kernel-source | Not affected |
SUSE Linux Enterprise Server 15 SP4-LTSS | kernel-default | Not affected |
SUSE Linux Enterprise Server 15 SP4-LTSS | kernel-source | Not affected |
SUSE Linux Enterprise Server 15 SP5 | kernel-source | Not affected |
SUSE Linux Enterprise Server 15 SP5 | kernel-source-azure | Not affected |
SUSE Linux Enterprise Server 15 SP5-LTSS | kernel-default | Not affected |
SUSE Linux Enterprise Server 15 SP5-LTSS | kernel-source | Not affected |
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 | kernel-source | Not affected |
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 | kernel-source-azure | Not affected |
SUSE Linux Enterprise Server for SAP Applications 15 SP3 | kernel-default | Not affected |
SUSE Linux Enterprise Server for SAP Applications 15 SP3 | kernel-source | Not affected |
SUSE Linux Enterprise Server for SAP Applications 15 SP4 | kernel-default | Not affected |
SUSE Linux Enterprise Server for SAP Applications 15 SP4 | kernel-source | Not affected |
SUSE Linux Enterprise Server for SAP Applications 15 SP5 | kernel-default | Not affected |
SUSE Linux Enterprise Server for SAP Applications 15 SP5 | kernel-source | Not affected |
SUSE Linux Enterprise Server for SAP Applications 15 SP5 | kernel-source-azure | Not affected |
Products past their end of life and not receiving proactive updates anymore. | ||
SUSE CaaS Platform 4.0 | kernel-source | Not affected |
SUSE Enterprise Storage 6 | kernel-source | Not affected |
SUSE Enterprise Storage 7 | kernel-source | Not affected |
SUSE Enterprise Storage 7.1 | kernel-source | Not affected |
SUSE Linux Enterprise Desktop 11 SP4 | kernel-source | Not affected |
SUSE Linux Enterprise Desktop 12 SP2 | kernel-source | Not affected |
SUSE Linux Enterprise Desktop 12 SP4 | kernel-source | Not affected |
SUSE Linux Enterprise Desktop 15 | kernel-source | Not affected |
SUSE Linux Enterprise Desktop 15 SP1 | kernel-source | Not affected |
SUSE Linux Enterprise Desktop 15 SP2 | kernel-source | Not affected |
SUSE Linux Enterprise Desktop 15 SP3 | kernel-source | Not affected |
SUSE Linux Enterprise Desktop 15 SP4 | kernel-source | Not affected |
SUSE Linux Enterprise Desktop 15 SP5 | kernel-source | Not affected |
SUSE Linux Enterprise High Performance Computing 15 | kernel-source | Not affected |
SUSE Linux Enterprise High Performance Computing 15 SP1 | kernel-source | Not affected |
SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS | kernel-source | Not affected |
SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS | kernel-source | Not affected |
SUSE Linux Enterprise High Performance Computing 15 SP2 | kernel-source | Not affected |
SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS | kernel-source | Not affected |
SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS | kernel-source | Not affected |
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | kernel-source | Not affected |
SUSE Linux Enterprise High Performance Computing 15-ESPOS | kernel-source | Not affected |
SUSE Linux Enterprise High Performance Computing 15-LTSS | kernel-source | Not affected |
SUSE Linux Enterprise Micro 5.0 | kernel-default | Not affected |
SUSE Linux Enterprise Module for Basesystem 15 | kernel-source | Not affected |
SUSE Linux Enterprise Module for Basesystem 15 SP1 | kernel-source | Not affected |
SUSE Linux Enterprise Module for Basesystem 15 SP2 | kernel-source | Not affected |
SUSE Linux Enterprise Module for Development Tools 15 | kernel-source | Not affected |
SUSE Linux Enterprise Module for Development Tools 15 SP1 | kernel-source | Not affected |
SUSE Linux Enterprise Module for Development Tools 15 SP2 | kernel-source | Not affected |
SUSE Linux Enterprise Point of Sale 12 SP2-CLIENT | kernel-source | Not affected |
SUSE Linux Enterprise Real Time 15 SP2 | kernel-source | Not affected |
SUSE Linux Enterprise Real Time 15 SP3 | kernel-source | Not affected |
SUSE Linux Enterprise Real Time 15 SP3 | kernel-source-rt | Not affected |
SUSE Linux Enterprise Real Time 15 SP4 | kernel-source | Not affected |
SUSE Linux Enterprise Real Time 15 SP4 | kernel-source-rt | Not affected |
SUSE Linux Enterprise Real Time 15 SP5 | kernel-source-rt | Not affected |
SUSE Linux Enterprise Server 11 SP4 | kernel-source | Not affected |
SUSE Linux Enterprise Server 11 SP4 LTSS | kernel-default | Not affected |
SUSE Linux Enterprise Server 11 SP4 LTSS | kernel-source | Not affected |
SUSE Linux Enterprise Server 11 SP4-LTSS | kernel-source | Not affected |
SUSE Linux Enterprise Server 12 SP2 | kernel-source | Not affected |
SUSE Linux Enterprise Server 12 SP2-BCL | kernel-source | Not affected |
SUSE Linux Enterprise Server 12 SP2-ESPOS | kernel-source | Not affected |
SUSE Linux Enterprise Server 12 SP2-LTSS | kernel-default | Not affected |
SUSE Linux Enterprise Server 12 SP2-LTSS | kernel-source | Not affected |
SUSE Linux Enterprise Server 12 SP4 | kernel-source | Not affected |
SUSE Linux Enterprise Server 12 SP4-ESPOS | kernel-source | Not affected |
SUSE Linux Enterprise Server 12 SP4-LTSS | kernel-default | Not affected |
SUSE Linux Enterprise Server 12 SP4-LTSS | kernel-source | Not affected |
SUSE Linux Enterprise Server 15 | kernel-source | Not affected |
SUSE Linux Enterprise Server 15 SP1 | kernel-source | Not affected |
SUSE Linux Enterprise Server 15 SP1-BCL | kernel-source | Not affected |
SUSE Linux Enterprise Server 15 SP1-LTSS | kernel-default | Not affected |
SUSE Linux Enterprise Server 15 SP1-LTSS | kernel-source | Not affected |
SUSE Linux Enterprise Server 15 SP2 | kernel-source | Not affected |
SUSE Linux Enterprise Server 15 SP2-BCL | kernel-source | Not affected |
SUSE Linux Enterprise Server 15 SP2-LTSS | kernel-default | Not affected |
SUSE Linux Enterprise Server 15 SP2-LTSS | kernel-source | Not affected |
SUSE Linux Enterprise Server 15 SP3-BCL | kernel-source | Not affected |
SUSE Linux Enterprise Server 15-LTSS | kernel-default | Not affected |
SUSE Linux Enterprise Server 15-LTSS | kernel-source | Not affected |
SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 | kernel-source | Not affected |
SUSE Linux Enterprise Server for SAP Applications 12 SP2 | kernel-source | Not affected |
SUSE Linux Enterprise Server for SAP Applications 12 SP4 | kernel-source | Not affected |
SUSE Linux Enterprise Server for SAP Applications 15 | kernel-source | Not affected |
SUSE Linux Enterprise Server for SAP Applications 15 SP1 | kernel-source | Not affected |
SUSE Linux Enterprise Server for SAP Applications 15 SP2 | kernel-source | Not affected |
SUSE Manager Proxy 4.0 | kernel-source | Not affected |
SUSE Manager Proxy 4.1 | kernel-source | Not affected |
SUSE Manager Proxy 4.2 | kernel-source | Not affected |
SUSE Manager Retail Branch Server 4.0 | kernel-source | Not affected |
SUSE Manager Retail Branch Server 4.1 | kernel-source | Not affected |
SUSE Manager Retail Branch Server 4.2 | kernel-source | Not affected |
SUSE Manager Server 4.0 | kernel-source | Not affected |
SUSE Manager Server 4.1 | kernel-source | Not affected |
SUSE Manager Server 4.2 | kernel-source | Not affected |
SUSE OpenStack Cloud 7 | kernel-source | Not affected |
SUSE OpenStack Cloud 9 | kernel-source | Not affected |
SUSE OpenStack Cloud Crowbar 9 | kernel-source | Not affected |
SUSE Real Time Module 15 SP3 | kernel-source-rt | Not affected |
SUSE Real Time Module 15 SP4 | kernel-source-rt | Not affected |
SUSE Real Time Module 15 SP5 | kernel-source-rt | Not affected |
openSUSE Leap 15.3 | kernel-source | Not affected |
openSUSE Leap 15.3 | kernel-source-rt | Not affected |
openSUSE Leap 15.4 | kernel-source | Not affected |
openSUSE Leap 15.4 | kernel-source-azure | Not affected |
openSUSE Leap 15.4 | kernel-source-rt | Not affected |
openSUSE Leap 15.5 | kernel-source | Not affected |
openSUSE Leap 15.5 | kernel-source-azure | Not affected |
openSUSE Leap 15.5 | kernel-source-rt | Not affected |
SUSE Timeline for this CVE
CVE page created: Thu Apr 17 16:08:14 2025CVE page last modified: Wed May 7 01:11:16 2025