In the Linux kernel, the following vulnerability has been resolved: nfsd: clean up potential nfsd_file refcount leaks in COPY codepath There are two different flavors of the nfsd4_copy struct. One is embedded in the compound and is used directly in synchronous copies. The other is dynamically allocated, refcounted and tracked in the client struture. For the embedded one, the cleanup just involves releasing any nfsd_files held on its behalf. For the async one, the cleanup is a bit more involved, and we need to dequeue it from lists, unhash it, etc. There is at least one potential refcount leak in this code now. If the kthread_create call fails, then both the src and dst nfsd_files in the original nfsd4_copy object are leaked. The cleanup in this codepath is also sort of weird. In the async copy case, we'll have up to four nfsd_file references (src and dst for both flavors of copy structure). They are both put at the end of nfsd4_do_async_copy, even though the ones held on behalf of the embedded one outlive that structure. Change it so that we always clean up the nfsd_file refs held by the embedded copy structure before nfsd4_copy returns. Rework cleanup_async_copy to handle both inter and intra copies. Eliminate nfsd4_cleanup_intra_ssc since it now becomes a no-op.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - nfsd: clean up potential nfsd_file refcount leaks in COPY codepath There are two different flavors of the     nfsd4_copy struct. One is embedded in the compound and is used directly in synchronous copies. The other     is dynamically allocated, refcounted and tracked in the client struture. For the embedded one, the cleanup     just involves releasing any nfsd_files held on its behalf. For the async one, the cleanup is a bit more     involved, and we need to dequeue it from lists, unhash it, etc. There is at least one potential refcount     leak in this code now. If the kthread_create call fails, then both the src and dst nfsd_files in the     original nfsd4_copy object are leaked. The cleanup in this codepath is also sort of weird. In the async     copy case, we'll have up to four nfsd_file references (src and dst for both flavors of copy structure).
    They are both put at the end of nfsd4_do_async_copy, even though the ones held on behalf of the embedded     one outlive that structure. Change it so that we always clean up the nfsd_file refs held by the embedded     copy structure before nfsd4_copy returns. Rework cleanup_async_copy to handle both inter and intra copies.
    Eliminate nfsd4_cleanup_intra_ssc since it now becomes a no-op. (CVE-2023-53606)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of kernel installed on the remote host is prior to 5.10.220-209.867. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2025-106 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    NFSD: Fix the behavior of READ near OFFSET_MAX (CVE-2022-48827)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSD: Fix ia_size underflow (CVE-2022-48828)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSD: Fix NFSv3 SETATTR/CREATE's handling of large file sizes (CVE-2022-48829)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSD: Protect against send buffer overflow in NFSv3 READ (CVE-2022-50345)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: call op_release, even when op_func returns an error (CVE-2023-53241)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: clean up potential nfsd_file refcount leaks in COPY codepath (CVE-2023-53606)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL (CVE-2023-53680)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: fix RELEASE_LOCKOWNER (CVE-2024-26629)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.15.156-102.160. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2024-049 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    net: dsa: fix panic when DSA master device unbinds on shutdown (CVE-2022-48808)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: call op_release, even when op_func returns an error (CVE-2023-53241)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSD: fix leaked reference count of nfsd4_ssc_umount_item (CVE-2023-53381)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: clean up potential nfsd_file refcount leaks in COPY codepath (CVE-2023-53606)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: fix RELEASE_LOCKOWNER (CVE-2024-26629)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables: disallow anonymous set with timeout flag (CVE-2024-26642)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout (CVE-2024-26643)

    In the Linux kernel, the following vulnerability has been resolved:

    xen/events: close evtchn after mapping cleanup (CVE-2024-26687)

    In the Linux kernel, the following vulnerability has been resolved:

    vfio/pci: Lock external INTx masking ops (CVE-2024-26810)

    In the Linux kernel, the following vulnerability has been resolved:

    vfio/pci: Create persistent INTx handler (CVE-2024-26812)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: Fix garbage collector racing against connect() (CVE-2024-26923)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path

    The commit mutex should not be released during the critical sectionbetween nft_gc_seq_begin() and     nft_gc_seq_end(), otherwise, async GCworker could collect expired objects and get the released commit     lockwithin the same GC sequence.

    nf_tables_module_autoload() temporarily releases the mutex to loadmodule dependencies, then it goes back     to replay the transaction again.Move it at the end of the abort phase after nft_gc_seq_end() is called.
    (CVE-2024-26925)

    In the Linux kernel, the following vulnerability has been resolved:

    USB: core: Fix deadlock in usb_deauthorize_interface() (CVE-2024-26934)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: core: Fix unremoved procfs host directory regression (CVE-2024-26935)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/i915/gt: Reset queue_priority_hint on parking (CVE-2024-26937)

    In the Linux kernel, the following vulnerability has been resolved:

    wireguard: netlink: access device through ctx instead of peer (CVE-2024-26950)

    In the Linux kernel, the following vulnerability has been resolved:

    wireguard: netlink: check for dangling peer via is_dead instead of empty list (CVE-2024-26951)

    In the Linux kernel, the following vulnerability has been resolved:

    nfs: fix UAF in direct writes (CVE-2024-26958)

    In the Linux kernel, the following vulnerability has been resolved:

    mm: swap: fix race between free_swap_and_cache() and swapoff() (CVE-2024-26960)

    In the Linux kernel, the following vulnerability has been resolved:

    mac802154: fix llsec key resources release in mac802154_llsec_key_del (CVE-2024-26961)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: xhci: Add error handling in xhci_map_urb_for_dma (CVE-2024-26964)

    In the Linux kernel, the following vulnerability has been resolved:

    fat: fix uninitialized field in nostale filehandles (CVE-2024-26973)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: Always flush async #PF workqueue when vCPU is being destroyed (CVE-2024-26976)

    In the Linux kernel, the following vulnerability has been resolved:

    pci_iounmap(): Fix MMIO mapping leak (CVE-2024-26977)

    In the Linux kernel, the following vulnerability has been resolved:

    xen-netfront: Add missing skb_mark_for_recycle (CVE-2024-27393)

    In the Linux kernel, the following vulnerability has been resolved:

    vfio/pci: Disable auto-enable of exclusive INTx IRQ (CVE-2024-27437)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region() (CVE-2024-35791)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: x86: Mark target gfn of emulated atomic instruction as dirty (CVE-2024-35804)

    In the Linux kernel, the following vulnerability has been resolved:

    dm snapshot: fix lockup in dm_exception_table_exit (CVE-2024-35805)

    In the Linux kernel, the following vulnerability has been resolved:

    PCI/PM: Drain runtime-idle callbacks before driver removal (CVE-2024-35809)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion (CVE-2024-35815)

    In the Linux kernel, the following vulnerability has been resolved:

    vt: fix unicode buffer corruption when deleting characters (CVE-2024-35823)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/secretmem: fix GUP-fast succeeding on secretmem folios (CVE-2024-35872)

    In the Linux kernel, the following vulnerability has been resolved:

    udp: do not accept non-tunnel GSO skbs landing in a tunnel (CVE-2024-35884)

    In the Linux kernel, the following vulnerability has been resolved:

    erspan: make sure erspan_base_hdr is present in skb->head (CVE-2024-35888)

    In the Linux kernel, the following vulnerability has been resolved:

    gro: fix ownership transfer (CVE-2024-35890)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, sockmap: Prevent lock inversion deadlock in map delete elem (CVE-2024-35895)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: validate user input for expected length (CVE-2024-35896)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables: discard table flag update with pending basechain deletion (CVE-2024-35897)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables: flush pending destroy work before exit_net release (CVE-2024-35899)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables: reject new basechain after table flag update (CVE-2024-35900)

    In the Linux kernel, the following vulnerability has been resolved:

    net/rds: fix possible cp null dereference (CVE-2024-35902)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: properly terminate timers for kernel sockets (CVE-2024-35910)

    In the Linux kernel, the following vulnerability has been resolved:

    block: prevent division by zero in blk_rq_stat_sum() (CVE-2024-35925)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: send: handle path ref underflow in header iterate_inode_ref() (CVE-2024-35935)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks() (CVE-2024-35936)

    In the Linux kernel, the following vulnerability has been resolved:

    VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host() (CVE-2024-35944)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/client: Fully protect modes[] with dev->mode_config.mutex (CVE-2024-35950)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5: Properly link new fs rules into the tree (CVE-2024-35960)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr (CVE-2024-35969)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: Clear stale u->oob_skb. (CVE-2024-35970)

    In the Linux kernel, the following vulnerability has been resolved:

    geneve: fix header validation in geneve[6]_xmit_skb (CVE-2024-35973)

    In the Linux kernel, the following vulnerability has been resolved:

    xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING (CVE-2024-35976)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPI: CPPC: Use access_width over bit_width for system memory accesses (CVE-2024-35995)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-138 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    drm: Fix potential null-ptr-deref due to drmm_mode_config_init() (CVE-2022-50556)

    A double-free vulnerability was found in the handling of IORING_OP_SOCKET operation with io_uring on the     Linux kernel. (CVE-2023-1032)

    Due to a type confusion during initializations, the tun and tap sockets in the Linux Kernel have their     socket UID hardcoded to 0, i.e. root. While it will be often correct, as TUN/TAP devices require     CAP_NET_ADMIN, it may not always be the case. The socket UID may be used for network filtering and     routing, thus TUN/TAP sockets may be incorrectly managed, potentially bypassing network filters based on     UID. (CVE-2023-1076)

    kernel: Type confusion in pick_next_rt_entity(), which can result in memory corruption. (CVE-2023-1077)

    A flaw use after free in the Linux kernel integrated infrared receiver/transceiver driver was found in the     way user detaching rc device. A local user could use this flaw to crash the system or potentially escalate     their privileges on the system. (CVE-2023-1118)

    A use-after-free vulnerability in the Linux Kernel traffic control index filter (tcindex) can be exploited     to achieve local privilege escalation. The tcindex_delete function which does not properly deactivate     filters in case of a perfect hashes while deleting the underlying structure which can later lead to double     freeing the structure. A local attacker user can use this vulnerability to elevate its privileges to     root.We recommend upgrading past commit 8c710f75256bb3cf05ac7b1672c82b92c43f3d28. (CVE-2023-1829)

    When plain IBRS is enabled (not enhanced IBRS), the logic in spectre_v2_user_select_mitigation()     determines that STIBP is not needed. The IBRS bit implicitly protects against cross-thread branch     targetinjection. However, with legacy IBRS, the IBRS bit is cleared on returning to userspace for     performance reasons which leaves userspace threads vulnerable to cross-thread branch target injection     against which STIBP protects. (CVE-2023-1998)

    A use-after-free flaw was found in hfsplus_put_super in fs/hfsplus/super.c in the Linux Kernel. This flaw     could allow a local user to cause a denial of service. (CVE-2023-2985)

    An issue was discovered in lib/kobject.c in the Linux kernel before 6.2.3. With root access, an attacker     can trigger a race condition that results in a fill_kobj_path out-of-bounds write. (CVE-2023-45863)

    In the Linux kernel, the following vulnerability has been resolved:

    vfio/type1: prevent underflow of locked_vm via exec() (CVE-2023-53171)

    In the Linux kernel, the following vulnerability has been resolved:

    USB: uhci: fix memory leak with using debugfs_lookup() (CVE-2023-53197)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: x_tables: fix percpu counter block leak on error path when creating new netns (CVE-2023-53200)

    In the Linux kernel, the following vulnerability has been resolved:

    PM: domains: fix memory leak with using debugfs_lookup() (CVE-2023-53202)

    In the Linux kernel, the following vulnerability has been resolved:

    driver core: location: Free struct acpi_pld_info *pld before return false (CVE-2023-53211)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64: efi: Make efi_rt_lock a raw_spinlock (CVE-2023-53216)

    In the Linux kernel, the following vulnerability has been resolved:

    watchdog: Fix kmemleak in watchdog_cdev_register (CVE-2023-53234)

    In the Linux kernel, the following vulnerability has been resolved:

    xsk: check IFF_UP earlier in Tx path (CVE-2023-53240)

    In the Linux kernel, the following vulnerability has been resolved:

    firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle (CVE-2023-53250)

    In the Linux kernel, the following vulnerability has been resolved:

    cacheinfo: Fix shared_cpu_map to handle shared caches at different levels (CVE-2023-53254)

    In the Linux kernel, the following vulnerability has been resolved:

    VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF (CVE-2023-53259)

    In the Linux kernel, the following vulnerability has been resolved:

    misc: vmw_balloon: fix memory leak with using debugfs_lookup() (CVE-2023-53279)

    In the Linux kernel, the following vulnerability has been resolved:

    udf: Do not update file length for failed writes to inline files (CVE-2023-53295)

    In the Linux kernel, the following vulnerability has been resolved:

    rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails (CVE-2023-53307)

    In the Linux kernel, the following vulnerability has been resolved:

    genirq/ipi: Fix NULL pointer deref in irq_data_get_affinity_mask() (CVE-2023-53332)

    In the Linux kernel, the following vulnerability has been resolved:

    USB: fix memory leak with using debugfs_lookup() (CVE-2023-53359)

    In the Linux kernel, the following vulnerability has been resolved:

    block: be a bit more careful in checking for NULL bdev while polling (CVE-2023-53366)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: seqiv - Handle EBUSY correctly (CVE-2023-53373)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSD: fix leaked reference count of nfsd4_ssc_umount_item (CVE-2023-53381)

    In the Linux kernel, the following vulnerability has been resolved:

    drivers: base: dd: fix memory leak with using debugfs_lookup() (CVE-2023-53390)

    In the Linux kernel, the following vulnerability has been resolved:

    trace/blktrace: fix memory leak with using debugfs_lookup() (CVE-2023-53408)

    In the Linux kernel, the following vulnerability has been resolved:

    drivers: base: component: fix memory leak with using debugfs_lookup() (CVE-2023-53409)

    In the Linux kernel, the following vulnerability has been resolved:

    PM: EM: fix memory leak with using debugfs_lookup() (CVE-2023-53411)

    In the Linux kernel, the following vulnerability has been resolved:

    objtool: Fix memory leak in create_static_call_sections() (CVE-2023-53423)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: Fix warning and UAF when destroy the MR list (CVE-2023-53427)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: Add lwtunnel encap size of all siblings in nexthop calculation (CVE-2023-53477)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu: Fix error unwind in iommu_group_alloc() (CVE-2023-53482)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: xts - Handle EBUSY correctly (CVE-2023-53494)

    In the Linux kernel, the following vulnerability has been resolved:

    udf: Do not bother merging very long extents (CVE-2023-53506)

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring: fix fget leak when fs don't support nowait buffered read (CVE-2023-53511)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: add a refcnt in sctp_stream_priorities to avoid a nested loop (CVE-2023-53590)

    In the Linux kernel, the following vulnerability has been resolved:

    driver core: fix resource leak in device_add() (CVE-2023-53594)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: clean up potential nfsd_file refcount leaks in COPY codepath (CVE-2023-53606)

    In the Linux kernel, the following vulnerability has been resolved:

    irqchip: Fix refcount leak in platform_irqchip_probe (CVE-2023-53610)

    In the Linux kernel, the following vulnerability has been resolved:

    nvme-tcp: don't access released socket during error recovery (CVE-2023-53643)

    In the Linux kernel, the following vulnerability has been resolved:

    srcu: Delegate work to the boot cpu if using SRCU_SIZE_SMALL (CVE-2023-53671)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/i915: Fix system suspend without fbdev being initialized (CVE-2023-53678)

    In the Linux kernel, the following vulnerability has been resolved:

    udf: Detect system inodes linked into directory hierarchy (CVE-2023-53695)

    In the Linux kernel, the following vulnerability has been resolved:

    ring-buffer: Handle race between rb_move_tail and rb_check_pages (CVE-2023-53709)

    kernel: refcount leak in ctnetlink_create_conntrack() (CVE-2023-7192)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
269348	Linux Distros Unpatched Vulnerability : CVE-2023-53606	Nessus	Misc.	high
266184	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2025-106 (ALASKERNEL-5.10-2025-106)	Nessus	Amazon Linux Local Security Checks	high
205715	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2024-049 (ALASKERNEL-5.15-2024-049)	Nessus	Amazon Linux Local Security Checks	high
204097	Photon OS 4.0: Linux PHSA-2024-4.0-0655	Nessus	PhotonOS Local Security Checks	high
173340	Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-138)	Nessus	Amazon Linux Local Security Checks	high

Detections

Analytics

CVE-2023-53606

medium

Tenable Plugins

high

high

high

high

high