Linux Kernel NFSv4 ACL Handling Vulnerability Leading to Memory Leak

A vulnerability in the Linux kernel's NFS server component (nfsd) has been identified, specifically within the NFSv4 ACL handling of the file creation process. The issue arises because the function responsible for converting NFSv4 ACLs to POSIX format discards error messages without proper handling. When this conversion fails, the file is created without an ACL, yet the client is incorrectly informed that the operation was successful. This behavior contradicts established NFS standards, which require the server to reject unsupported attributes during file creation. Additionally, when the file creation process encounters an error after ACL attributes have been set, the function fails to release the allocated POSIX ACLs, causing a memory leak. This vulnerability can be exploited by clients that send invalid filenames along with ACL attributes, triggering the issue repeatedly.

Impact

Exploitation of this vulnerability leads to a memory leak, where allocated POSIX ACLs are not properly freed, causing unnecessary memory consumption that could potentially be exploited to disrupt normal system operations.

Reproduction

To reproduce this vulnerability, a client can initiate an OPEN(CREATE) operation while including ACL attributes and an invalid filename, such as one that exceeds the maximum allowed length. This will cause the NFS server to create the file without the appropriate ACL, all while failing to handle the error correctly, thus leaking memory.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been addressed. Instructions for downloading the patched version are available on the Linux kernel's official website.