Linux Kernel NFS Layout State ID Release Vulnerability on Lease Set Failure

A vulnerability in the Linux kernel's NFS server implementation can lead to a use-after-free issue. When a layout state ID (stid) is allocated and then a lease set operation fails, the state ID is freed without properly removing it from the IDR (Identifier Radix Tree) management. This leaves a dangling pointer that can be accessed by subsequent operations, potentially causing memory corruption. The vulnerability arises because the error handling path does not follow the correct procedure for releasing the state ID, leading to a situation where freed memory can be incorrectly accessed.

Impact

Exploitation of this vulnerability can cause a use-after-free condition, where a pointer to freed memory is dereferenced, potentially leading to memory corruption.

Reproduction

The vulnerability can be reproduced by allocating a layout state ID in the NFS server, then triggering a failure in the lease set operation. This failure will cause the state ID to be freed without removing it from the IDR management, creating a dangling pointer that can be accessed by other operations.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been addressed.