Vulnerability: The nfs_can_extend_write function in fs/nfs/write.c in the Linux kernel before 3.13.3 relies on a write delegation to extend a write operation without a certain up-to-date verification, which allows local users to obtain sensitive information from kernel memory in opportunistic circumstances by writing to a file in an NFS filesystem and then reading the same file.
Vulnerability ID: CVE-2014-2038
CWE: CWE-200
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2014-02-28
File: fs/nfs/write.c
Commit message: nfs: always make sure page is up-to-date before extending a write to cover the entire page

We should always make sure the cached page is up-to-date when we're
determining whether we can extend a write to cover the full page -- even
if we've received a write delegation from the server.

Commit c7559663 added logic to skip this check if we have a write
delegation, which can lead to data corruption such as the following
scenario if client B receives a write delegation from the NFS server:

Client A:
    # echo 123456789 > /mnt/file

Client B:
    # echo abcdefghi >> /mnt/file
    # cat /mnt/file
    0�D0�abcdefghi

Just because we hold a write delegation doesn't mean that we've read in
the entire page contents.

Cc: <stable@vger.kernel.org> # v3.11+
Signed-off-by: Scott Mayhew <smayhew@redhat.com>
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
Commit author: Scott Mayhew

Vulnerable version (before fix):
 static bool nfs_write_pageuptodate(struct page *page, struct inode *inode)  * extend the write to cover the entire page in order to avoid fragmentation  * inefficiencies.  *  * If the file is opened for synchronous writes or if we have a write delegation  * from the server then we can just skip the rest of the checks.  */ static int nfs_can_extend_write(struct file *file, struct page *page, struct inode *inode) { 	if (file->f_flags & O_DSYNC) 		return 0; 	if (NFS_PROTO(inode)->have_delegation(inode, FMODE_WRITE)) 		return 1; 	if (nfs_write_pageuptodate(page, inode) && (inode->i_flock == NULL || 			(inode->i_flock->fl_start == 0 && 			inode->i_flock->fl_end == OFFSET_MAX && 			inode->i_flock->fl_type != F_RDLCK))) 		return 1; 	return 0; }

Fixed version (after fix):
 static bool nfs_write_pageuptodate(struct page *page, struct inode *inode)  * extend the write to cover the entire page in order to avoid fragmentation  * inefficiencies.  *  * If the file is opened for synchronous writes then we can just skip the rest  * of the checks.  */ static int nfs_can_extend_write(struct file *file, struct page *page, struct inode *inode) { 	if (file->f_flags & O_DSYNC) 		return 0; 	if (!nfs_write_pageuptodate(page, inode)) 		return 0; 	if (NFS_PROTO(inode)->have_delegation(inode, FMODE_WRITE)) 		return 1; 	if (inode->i_flock == NULL || (inode->i_flock->fl_start == 0 && 			inode->i_flock->fl_end == OFFSET_MAX && 			inode->i_flock->fl_type != F_RDLCK)) 		return 1; 	return 0; }

Patch:
patch: @@ -922,19 +922,20 @@ static bool nfs_write_pageuptodate(struct page *page, struct inode *inode)
  * extend the write to cover the entire page in order to avoid fragmentation
  * inefficiencies.
  *
- * If the file is opened for synchronous writes or if we have a write delegation
- * from the server then we can just skip the rest of the checks.
+ * If the file is opened for synchronous writes then we can just skip the rest
+ * of the checks.
  */
 static int nfs_can_extend_write(struct file *file, struct page *page, struct inode *inode)
 {
 	if (file->f_flags & O_DSYNC)
 		return 0;
+	if (!nfs_write_pageuptodate(page, inode))
+		return 0;
 	if (NFS_PROTO(inode)->have_delegation(inode, FMODE_WRITE))
 		return 1;
-	if (nfs_write_pageuptodate(page, inode) && (inode->i_flock == NULL ||
-			(inode->i_flock->fl_start == 0 &&
+	if (inode->i_flock == NULL || (inode->i_flock->fl_start == 0 &&
 			inode->i_flock->fl_end == OFFSET_MAX &&
-			inode->i_flock->fl_type != F_RDLCK)))
+			inode->i_flock->fl_type != F_RDLCK))
 		return 1;
 	return 0;
 }
path: fs/nfs/write.c