Linux NFSD: TOCTOU lets a SETATTR truncate an append-only file

Impact

nfsd_setattr() decides whether a size change needs NFSD_MAY_TRUNC using an unlocked read of i_size, then applies ATTR_SIZE later under inode_lock. A concurrent append can extend the file inside that window, so notify_change() performs a real truncation that never went through the IS_APPEND() rejection the VFS truncate paths enforce. For an operator the consequence is integrity, not code execution: append-only files on an NFS export - audit trails, job logs, checkpoint journals written by training runs - can be shortened by a client that should not be able to shorten them. Affects any host exporting NFS where append-only immutability is relied on.

Who can reach it

Any NFS client that can send SETATTR to an export, racing an append to the same file. Authentication is whatever the export requires; no local access on the server.

What to do

Apply the stable fix, which rechecks the requested size against i_size after inode_lock and before notify_change(), and reboot the NFS server node. No configuration mitigation short of removing append-only reliance on NFS-exported files. The record names stable commits only, not a released version.

References

Related entries

• QEMU VGA device model (hw/display/vga.c) - banked access to video memory: 'Dark Portal' - the guest sets the VGA bankCVE-2016-3710 · QEMU VGA device model (hw/display/vga.c) - banked access to video memoryHigh
• Xen x86 PV pagetable update fast paths (arch/x86/mm.c): A 32-bit PV guest administrator gains full host privileges byCVE-2016-6258 · Xen x86 PV pagetable update fast paths (arch/x86/mm.c)High
• VMware ESXi (OpenSLP): OpenSLP heap overflow - the ESXiArgs ransomware entry point that mass-encrypted thousandsCVE-2021-21974 · VMware ESXi (OpenSLP)High
• Linux KVM x86 - stack out-of-bounds in ioapic_write_indirect(): A guest write to the virtual IOAPIC causes a stackCVE-2021-47390 · Linux KVM x86 - stack out-of-bounds in ioapic_write_indirect()High
• Xen (xenstored): Guest can crash xenstored, taking down control-plane services for all guests on the hostCVE-2022-42309 · Xen (xenstored)High
• Linux kernel drivers/vdpa/mlx5 (mlx5 vDPA net device): A guest with an assigned mlx5 vDPA net device sends anCVE-2022-48864 · Linux kernel drivers/vdpa/mlx5 (mlx5 vDPA net device)High