kernel: nfs_atomic_open() returns uninitialized data instead of ENOTDIR

A flaw was found in the Linux kernel. When an application tries to open a directory using the ODIRECTORY flag in a mounted NFS filesystem, a lookup operation is performed. If the NFS server returns a file as a result of the lookup, the NFS filesystem returns an uninitialized file descriptor inste...

An issue was discovered in fs/nfs/dir.c in the Linux kernel before 5.16.5. If an application sets the O_DIRECTORY flag and tries to open a regular file nfs_atomic_open() performs a regular lookup. If a regular file is found ENOTDIR should occur but the server instead returns uninitialized data in the file descriptor.

...

PT-2022-1572

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.16.5 Description An issue was discovered in the Linux kernel where the nfs atomic open function performs a regular lookup when an application sets the O DIRECTORY flag and tries to open a regular file. Instead ...