Executive Summary

This vulnerability exists in the Linux kernel's sunrpc subsystem, specifically related to the handling of cache_request objects. When a reader's file descriptor is closed while it is in the middle of reading a cache_request, the function cache_release() decreases the reader count but does not properly check if the cache_request should be freed. This leads to a situation where the cache_request is not removed from the queue or freed, causing a resource leak.

The issue arises because cache_release() lacks the cleanup logic that is present in cache_read(), which frees the cache_request when the reader count drops to zero and the CACHE_PENDING flag is clear. If the CACHE_PENDING flag was already cleared while readers were still present, the cache_dequeue() function, which also frees requests, will have skipped the request. As a result, no subsequent function frees the cache_request, causing a leak.

The fix involves adding the cleanup logic from cache_read() to cache_release(), so that after decrementing the reader count, it checks if the count reached zero with CACHE_PENDING clear, and if so, dequeues and frees the cache_request.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to a resource leak in the Linux kernel's sunrpc subsystem. Specifically, cache_request objects may not be freed properly, causing memory or resource consumption to increase over time.

Such leaks can degrade system performance, potentially leading to exhaustion of kernel memory or other resources, which might cause system instability or crashes if the leak is severe or exploited repeatedly.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability is fixed by updating the Linux kernel to a version where the cache_request leak in sunrpc's cache_release function is resolved.

Immediate mitigation steps include applying the latest kernel patches or upgrading to a kernel version that contains the fix for this issue.

Useful 0 Not Useful 0