In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix ia_size underflow iattr::ia_size is a loff_t, which is a signed 64-bit type. NFSv3 and NFSv4 both define file size as an unsigned 64-bit type. Thus there is a range of valid file size values an NFS client can send that is already larger than Linux can handle. Currently decode_fattr4() dumps a full u64 value into ia_size. If that value happens to be larger than S64_MAX, then ia_size underflows. I'm about to fix up the NFSv3 behavior as well, so let's catch the underflow in the common code path: nfsd_setattr().
En el kernel de Linux, se resolvió la siguiente vulnerabilidad: NFSD: corrija el desbordamiento insuficiente de ia_size iattr::ia_size es un loff_t, que es un tipo de 64 bits firmado. NFSv3 y NFSv4 definen el tamaño del archivo como un tipo de 64 bits sin firmar. Por lo tanto, existe un rango de valores de tamaño de archivo válidos que un cliente NFS puede enviar y que ya es mayor de lo que Linux puede manejar. Actualmente, decode_fattr4() vuelca un valor u64 completo en ia_size. Si ese valor resulta ser mayor que S64_MAX, entonces ia_size tiene un desbordamiento insuficiente. También estoy a punto de arreglar el comportamiento de NFSv3, así que detectemos el desbordamiento en la ruta del código común: nfsd_setattr().
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | LOW |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | NONE |
| Integrity Impact | NONE |
| Availability Impact | HIGH |
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
CWE-191
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd36b86ef00> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd36059e0c0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd369ed77c0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd3695adc40> | Operating System |
| linux | linux_kernel | 5.17 | <built-in method update of dict object at 0x7fd36b86e940> | Operating System |
| linux | linux_kernel | 5.17 | <built-in method update of dict object at 0x7fd36b86e600> | Operating System |
| linux | linux_kernel | 5.17 | <built-in method update of dict object at 0x7fd349465480> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:5.17:rc1:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:5.17:rc2:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:5.17:rc3:*:*:*:*:*:* |