High · published March 25, 2024
In the Linux kernel, the following vulnerability has been resolved:
NFSv4: Fix a NULL pointer dereference in pnfs_mark_matching_lsegs_return()
Commit de144ff4234f changes _pnfs_return_layout() to call
pnfs_mark_matching_lsegs_return() passing NULL as the struct
pnfs_layout_range argument. Unfortunately,
pnfs_mark_matching_lsegs_return() doesn't check if we have a value here
before dereferencing it, causing an oops.
I'm able to hit this crash consistently when running connectathon basic
tests on NFS v4.1/v4.2 against Ontap.
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | ≥ 4.9.269, < 4.9.271 | 4.9.271 |
| linux/linux_kernel | ≥ 4.14.233, < 4.14.235 | 4.14.235 |
| linux/linux_kernel | ≥ 4.19.191, < 4.19.193 | 4.19.193 |
| linux/linux_kernel | ≥ 5.4.118, < 5.4.124 | 5.4.124 |
| linux/linux_kernel | ≥ 5.10.36, < 5.10.42 | 5.10.42 |
| linux/linux_kernel | ≥ 5.12.3, < 5.12.9 | 5.12.9 |