nfsm_mbuftouio ignores copyout() fault — NFS read() reports full success with stale destination bytes
| Field | Value |
|---|---|
| ID | DF-3053 |
| Status | new |
| Severity | Low |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N |
| CWE | CWE-252 |
| File | sys/vfs/nfs/nfsm_subs.c |
| Lines | 1071-1083 |
| Area | vfs/nfs |
| Confidence | certain |
| Discovered | 2026-09-02 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | base:vfs |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
In the UIO_USERSPACE branch of nfsm_mbuftouio() the return value of copyout() is discarded: on a fault (destination page concurrently munmap(2)'ed or mprotect(PROT_NONE)'ed during an NFS read) the data is silently not delivered, yet uio_resid/uio_offset are still decremented and the loop continues — the subsequent read(2)/readdir(2) returns complete success with the user buffer holding pre-existing bytes instead of returning EFAULT. Any unprivileged user on an NFS-mounted filesystem racing munmap/mprotect against read(2) gets a silent short-delivery reported as full success — a data-integrity failure (stale buffer contents trusted as fresh file data). No kernel-memory disclosure and no memory unsafety. Fix: check and propagate the fault (row diff).
Timeline
- 2026-09-02 Discovered during pass-2 audit of nfsm_subs.c (GLM 5.3).
No comments yet.