CVE-2023-53606
Description
A reference leak flaw was found in the Linux kernel's NFS server implementation in the file copy operation handling. A local user can trigger this issue when asynchronous copy operations fail to create worker threads, causing nfsd_file references held by the embedded copy structure to leak. This results in permanent reference leaks preventing proper file cleanup and leading to resource exhaustion and denial of service.
Statement
The NFSD COPY operation supports both synchronous and asynchronous modes. For synchronous copies, an nfsd4_copy structure is embedded in the compound and holds nfsd_file references for the duration of the operation. For asynchronous copies, a separate dynamically allocated structure is created with its own references. The cleanup logic is asymmetric—the async copy structure releases its references in nfsd4_do_async_copy, but this function also releases the references from the embedded structure, even though that structure outlives the async operation. Additionally, if kthread_create fails for async copies, neither set of references is properly released, creating a permanent leak. The fix ensures embedded structure references are always cleaned up before the function returns and consolidates cleanup logic.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | 5.5 | 7.5 |
| Attack Vector | Local | Local | Network |
| Attack Complexity | Low | Low | Low |
| Privileges Required | Low | Low | None |
| User Interaction | None | None | None |
| Scope | Unchanged | Unchanged | Unchanged |
| Confidentiality | None | None | None |
| Integrity Impact | None | None | None |
| Availability Impact | High | High | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
An adversary that can cause a resource counter to become inaccurate may be able to create situations where resources are not accounted for and not released, thus causing resources to become scarce for future needs.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
An adversary that can cause a resource counter to become inaccurate may be able to force an error that causes the product to crash or exit out of its current operation.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
