CVE-2023-53711

Vulnerability

Description

A data corruption vulnerability exists in the Linux kernel's NFS subsystem. The root cause is a missing synchronization step during the retransmission of direct I/O (O_DIRECT) write requests. When the server acknowledges a synchronous write, the client's head request must be rejoined with its subrequests and re-added to the retransmission list. The code lacked the equivalent of nfs_cancel_remove_inode() for O_DIRECT, leaving the head request detached from the commit lists and causing potential data corruption upon retransmission.

Attack

Vector and Exploitation

Exploitation occurs when an NFS client sends O_DIRECT writes and a network issue forces a retransmission. An attacker with the ability to trigger or coincide with such a fault – for example, by causing network partitions or packet loss – can take advantage of the missing call to corrupt file data. No special privileges beyond network access to the NFS traffic are required; the corruption manifests during normal write retry operations.

Impact

If successfully triggered, the vulnerability causes silent data corruption in files written via O_DIRECT over NFS. The corrupted data would be persisted to the server and could affect any subsequently read file contents, potentially compromising application integrity or causing data loss.

Mitigation

The fix is included in upstream Linux kernel commits [1] and [2]. Users should apply the latest stable kernel updates from their distribution. No workaround other than patching is known; systems using NFS with O_DIRECT are at risk.