{
   "containers": {
      "cna": {
         "providerMetadata": {
            "orgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038"
         },
         "descriptions": [
            {
               "lang": "en",
               "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix handling of cached open files in nfsd4_open codepath\n\nCommit fb70bf124b05 (\"NFSD: Instantiate a struct file when creating a\nregular NFSv4 file\") added the ability to cache an open fd over a\ncompound. There are a couple of problems with the way this currently\nworks:\n\nIt's racy, as a newly-created nfsd_file can end up with its PENDING bit\ncleared while the nf is hashed, and the nf_file pointer is still zeroed\nout. Other tasks can find it in this state and they expect to see a\nvalid nf_file, and can oops if nf_file is NULL.\n\nAlso, there is no guarantee that we'll end up creating a new nfsd_file\nif one is already in the hash. If an extant entry is in the hash with a\nvalid nf_file, nfs4_get_vfs_file will clobber its nf_file pointer with\nthe value of op_file and the old nf_file will leak.\n\nFix both issues by making a new nfsd_file_acquirei_opened variant that\ntakes an optional file pointer. If one is present when this is called,\nwe'll take a new reference to it instead of trying to open the file. If\nthe nfsd_file already has a valid nf_file, we'll just ignore the\noptional file and pass the nfsd_file back as-is.\n\nAlso rework the tracepoints a bit to allow for an \"opened\" variant and\ndon't try to avoid counting acquisitions in the case where we already\nhave a cached open file."
            }
         ],
         "affected": [
            {
               "product": "Linux",
               "vendor": "Linux",
               "defaultStatus": "unaffected",
               "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               "programFiles": [
                  "fs/nfsd/filecache.c",
                  "fs/nfsd/filecache.h",
                  "fs/nfsd/nfs4state.c",
                  "fs/nfsd/trace.h"
               ],
               "versions": [
                  {
                     "version": "c20097329d2c",
                     "lessThan": "45c08a752982",
                     "status": "affected",
                     "versionType": "git"
                  },
                  {
                     "version": "106331a12b0f",
                     "lessThan": "0b778361998d",
                     "status": "affected",
                     "versionType": "git"
                  },
                  {
                     "version": "fb70bf124b05",
                     "lessThan": "973acfdfe90c",
                     "status": "affected",
                     "versionType": "git"
                  },
                  {
                     "version": "fb70bf124b05",
                     "lessThan": "0b3a551fa58b",
                     "status": "affected",
                     "versionType": "git"
                  }
               ]
            },
            {
               "product": "Linux",
               "vendor": "Linux",
               "defaultStatus": "affected",
               "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               "programFiles": [
                  "fs/nfsd/filecache.c",
                  "fs/nfsd/filecache.h",
                  "fs/nfsd/nfs4state.c",
                  "fs/nfsd/trace.h"
               ],
               "versions": [
                  {
                     "version": "5.19",
                     "status": "affected"
                  },
                  {
                     "version": "0",
                     "lessThan": "5.19",
                     "status": "unaffected",
                     "versionType": "custom"
                  },
                  {
                     "version": "6.1.7",
                     "lessThanOrEqual": "6.1.*",
                     "status": "unaffected",
                     "versionType": "custom"
                  },
                  {
                     "version": "6.2",
                     "lessThanOrEqual": "*",
                     "status": "unaffected",
                     "versionType": "original_commit_for_fix"
                  }
               ]
            }
         ],
         "references": [
            {
               "url": "https://git.kernel.org/stable/c/45c08a752982116f3287afcd1bd9c50f4fab0c28"
            },
            {
               "url": "https://git.kernel.org/stable/c/0b778361998d6c6356b8d2fc7ddf025fb3224654"
            },
            {
               "url": "https://git.kernel.org/stable/c/973acfdfe90c8a4e58ade97ff0653a498531ff2e"
            },
            {
               "url": "https://git.kernel.org/stable/c/0b3a551fa58b4da941efeb209b3770868e2eddd7"
            }
         ],
         "title": "nfsd: fix handling of cached open files in nfsd4_open codepath",
         "x_generator": {
            "engine": "bippy-c9c4e1df01b2"
         }
      }
   },
   "cveMetadata": {
      "assignerOrgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038",
      "cveID": "CVE-2023-52909",
      "requesterUserId": "gregkh@kernel.org",
      "serial": "1",
      "state": "PUBLISHED"
   },
   "dataType": "CVE_RECORD",
   "dataVersion": "5.0"
}