In the Linux kernel, the following vulnerability has been resolved:

NFS: Fix LTP test failures when timestamps are delegated

The utimes01 and utime06 tests fail when delegated timestamps are enabled, specifically in subtests that modify the atime and mtime fields using the nobody user ID.

The problem can be reproduced as follow:

echo /media *(rw,no_root_squash,sync) » /etc/exports

export -ra

mount -o rw,nfsvers=4.2 127.0.0.1:/media /tmpdir

cd /opt/ltp

./runltp -d /tmpdir -s utimes01

./runltp -d /tmpdir -s utime06

This issue occurs because nfs_setattr does not verify the inodes UID against the callers fsuid when delegated timestamps are permitted for the inode.

This patch adds the UID check and if it does not match then the request is sent to the server for permission checking.

Affected Software

References

• https://git.kernel.org/stable/c/0e9be902041c6b9f0ed4b72764187eed1067a42f
• https://git.kernel.org/stable/c/b2e4cda71ed062c87573b016d2d956a62f4258ed
• https://git.kernel.org/stable/c/b623390045a81fc559decb9bfeb79319721d3dfb