CVE-2023-53711
Description
A logic error was found in the Linux kernel's NFS client implementation in the write request retransmission handling for O_DIRECT operations. A local user performing direct I/O writes over NFS can trigger this issue when the server completes writes synchronously and network conditions require retransmission, causing subrequests to not be properly rejoined to the head request before retransmit. This results in data corruption where written data may not be correctly persisted to the server.
Statement
NFS write operations can be split into multiple subrequests, which must be rejoined to the head request before any retransmission occurs. When an NFS server handles a write synchronously rather than through the commit mechanism, the head request bypasses the normal commit list path. If retransmission becomes necessary due to network issues, the code failed to add the head back to the retransmission list, leaving subrequests orphaned. This causes incomplete or corrupted writes to the server without returning errors to the application. Triggering the bug requires local access to an NFS-mounted filesystem using O_DIRECT, combined with server-side synchronous write behavior and network conditions that prompt retransmission.
Mitigation
To mitigate this issue, avoid using O_DIRECT for writes on NFS mounts until updates are applied. Alternatively, prevent the nfs module from being loaded if NFS is not required. See https://access.redhat.com/solutions/41278 for instructions on blacklisting kernel modules.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | 8.2 |
| Attack Vector | Local | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | High |
| Availability Impact | High | N/A | Low |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
Understanding the Weakness (CWE)
Integrity,Confidentiality,Other
Technical Impact: Modify Application Data; Read Application Data; Alter Execution Logic
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
