CVE-2023-1652

What it actually does

A use-after-free vulnerability in nfsd4_ssc_setup_dul within the Linux kernel NFS server code allows a local authenticated user to trigger memory corruption after an object is freed, enabling either a kernel panic or disclosure of kernel memory contents.

Why it matters to the business

Linux systems hosting NFS shares may experience sudden crashes causing service outages or exposure of sensitive kernel data, increasing operational downtime and compliance risks on servers that provide file sharing.

How an attack unfolds

A local attacker with low-privileged access on a Linux host running the NFS server issues crafted NFSv4 operations that reach nfsd4_ssc_setup_dul, causing the kernel to reference memory after it has been freed and thereby crashing the system or leaking kernel data.

How to fix it

Upgrade the Linux kernel to a version containing commit 9cf4111cdf9420fa99792ae16c8de23242bb2e0b or later; rebuild and reboot affected systems with the patched kernel.

How to confirm the fix worked

Confirm the running kernel contains commit 9cf4111cdf9420fa99792ae16c8de23242bb2e0b, verify the patched nfs4proc.c source, and test that NFS server operations no longer trigger use-after-free warnings under memory debugging tools.

Typical attack path

1. Obtain local shell access on a Linux system exporting NFS shares
2. Issue NFSv4 compound operations that invoke nfsd4_ssc_setup_dul
3. Trigger the use-after-free condition to induce kernel panic or read freed memory

How to detect it

Review kernel ring buffer and syslog for oops or panic entries referencing nfsd or nfs4proc.c; correlate with NFSv4 traffic spikes in audit logs.

What your security team should do

• Prioritize kernel updates on all NFS-exporting Linux hosts
• Apply the fix within standard change windows given the local attack vector and low EPSS
• Restrict local user access on NFS servers and monitor kernel logs for related oops messages