Bug 2563152 (CVE-2026-123042)
| Summary: | CVE-2026-123042 nfs-ganesha: nfs-ganesha: NFSv4.1 cached-READ session-slot replay causes double-free and use-after-free read | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | amctagga, aoconnor, bniver, flucifre, gmeno, groman, mbenjamin, mhackett, sostapov, vereddy |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A double-free and use-after-free vulnerability was found in NFS-Ganesha. When an NFSv4.1 COMPOUND request caches a READ reply in the session-slot replay cache, the READ data buffer is freed on first transmission but the cache retains a dangling pointer. A subsequent legal protocol replay re-sends the freed buffer contents to the client and frees the pointer again, resulting in remote heap information disclosure and a daemon crash.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
A vulnerability was found in NFS-Ganesha's core NFSv4.1 compound dispatcher. When a COMPOUND request includes a SEQUENCE operation with sa_cachethis=TRUE and a READ operation, the zero-copy READ buffer is freed when the reply is first transmitted. However, the NFSv4.1 session-slot reply cache stores the reply object by shallow pointer, retaining a dangling reference to the freed buffer. RFC 5661 §2.10.6.2 permits a client to resend the same slot ID and sequence ID as a legal replay. When the server handles such a replay, it re-encodes the freed READ buffer onto the wire (use-after-free read, disclosing heap contents to the remote client) and frees the same pointer again on send completion (double-free, corrupting the allocator and crashing the daemon). The replay count is unbounded. The bug is in the FSAL-independent core (nfs4_op_read.c, rpc_tools.c, nfs4_Compound.c, nfs4_op_sequence.c), so every FSAL backend (VFS, CEPH, GLUSTER, RGW, MEM) is affected. The vulnerability was introduced in commit 48e5220b2 ("Make read path use iovec all the way through"), first released in V6.0. V5.9 and earlier are not affected. On AUTH_SYS/AUTH_NONE exports (the common default), no real credential is required — the client asserts any uid. The attack is deterministic (not a race condition) and requires only TCP reachability to the NFS port. An end-to-end PoC establishes an NFSv4.1 session, creates a file, issues a cached READ, and triggers the crash in a single shot. Impact: - Remote denial of service: double-free corrupts the heap allocator and crashes ganesha.nfsd. Trivially sustained as a crash-loop on restart. - Remote heap information disclosure: each replay re-encodes a freed, potentially reoccupied heap chunk of attacker-controlled size and sends it to the client. Upstream: unfixed as of V15.9 (current tip of the next branch).