Description
In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent a potential integer overflow If the tag length is >= U32_MAX - 3 then the "length + 4" addition can result in an integer overflow. Address this by splitting the decoding into several steps so that decode_cb_compound4res() does not have to perform arithmetic on the unsafe length value.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 745f7ce5a95e783ba62fe774325829466aec2aa8affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 90adbae9dd158da8331d9fdd32077bd1af04f553affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 3c5f545c9a1f8a1869246f6f3ae8c17289d6a841affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 842f1c27a1aef5367e535f9e85c8c3b06352151aaffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < de53c5305184ca1333b87e695d329d1502d694ceaffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < dde654cad08fdaac370febb161ec41eb58e9d2a2affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 084f797dbc7e52209a4ab6dbc7f0109268754eb9affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < ccd3394f9a7200d6b088553bf38e688620cd27afaffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 7f33b92e5b18e904a481e6e208486da43e4dc841affected
Linux Linux
Default version status: affected
2.6.12affected0 to < 2.6.12unaffected4.19.325 to ≤ 4.19.*unaffected5.4.287 to ≤ 5.4.*unaffected5.10.231 to ≤ 5.10.*unaffected5.15.174 to ≤ 5.15.*unaffected6.1.120 to ≤ 6.1.*unaffected6.6.64 to ≤ 6.6.*unaffected6.11.11 to ≤ 6.11.*unaffected6.12.2 to ≤ 6.12.*unaffected6.13 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/745f7ce5a95e783ba62fe774325829466aec2aa8 ↗
- https://git.kernel.org/stable/c/90adbae9dd158da8331d9fdd32077bd1af04f553 ↗
- https://git.kernel.org/stable/c/3c5f545c9a1f8a1869246f6f3ae8c17289d6a841 ↗
- https://git.kernel.org/stable/c/842f1c27a1aef5367e535f9e85c8c3b06352151a ↗
- https://git.kernel.org/stable/c/de53c5305184ca1333b87e695d329d1502d694ce ↗
- https://git.kernel.org/stable/c/dde654cad08fdaac370febb161ec41eb58e9d2a2 ↗
- https://git.kernel.org/stable/c/084f797dbc7e52209a4ab6dbc7f0109268754eb9 ↗
- https://git.kernel.org/stable/c/ccd3394f9a7200d6b088553bf38e688620cd27af ↗
- https://git.kernel.org/stable/c/7f33b92e5b18e904a481e6e208486da43e4dc841 ↗
- https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html ↗
- https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html ↗