Description
In the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr nfs4_decode_mp_ds_addr() decodes the r_netid and r_addr opaques of a netaddr4 from a GETDEVICEINFO multipath-DS body, then immediately calls strrchr(buf, '.') to locate the port separator. Both decodes use xdr_stream_decode_string_dup(), and the current code checks only "nlen < 0" / "rlen < 0" before dereferencing the returned string. When the on-wire opaque has length zero, xdr_stream_decode_opaque_inline() returns 0 and xdr_stream_decode_string_dup() falls through to its "*str = NULL; return ret" tail, leaving buf NULL with a return value of 0. The "< 0" check does not catch this, and the next line is strrchr(NULL, '.'), a kernel NULL pointer dereference reachable from any pNFS-flexfile client mounted against a malicious or compromised metadata server. Reject the zero-length cases explicitly so the decoder fails with -EBADMSG (treated as a malformed GETDEVICEINFO body) instead of panicking the client.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
6b7f3cf96364eaf597940cb5c68a682894829915 to < 76b94cbd32aacf36a641956385a852635c6802b9affected6b7f3cf96364eaf597940cb5c68a682894829915 to < c8e4e0c701d0192a2efb6df059c0f9e19678c23daffected6b7f3cf96364eaf597940cb5c68a682894829915 to < 6c344fff2feff9d4d716d8e4ad40e9b5040ee5eaaffected6b7f3cf96364eaf597940cb5c68a682894829915 to < 427ab81a811dab4bca9d19f82eec5847ae42646eaffected6b7f3cf96364eaf597940cb5c68a682894829915 to < 012d37a568bfbb2c9686f03ade75560bc7139956affected6b7f3cf96364eaf597940cb5c68a682894829915 to < 30aae62e50b4e074a90a9a5e15246548fbdc1182affected6b7f3cf96364eaf597940cb5c68a682894829915 to < 41fe0f7b84f0cb822ae10ab08592996a592b2a25affected
Linux Linux
Default version status: affected
4.0affected0 to < 4.0unaffected5.15.211 to ≤ 5.15.*unaffected6.1.177 to ≤ 6.1.*unaffected6.6.144 to ≤ 6.6.*unaffected6.12.95 to ≤ 6.12.*unaffected6.18.38 to ≤ 6.18.*unaffected7.1.3 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/76b94cbd32aacf36a641956385a852635c6802b9 ↗
- https://git.kernel.org/stable/c/c8e4e0c701d0192a2efb6df059c0f9e19678c23d ↗
- https://git.kernel.org/stable/c/6c344fff2feff9d4d716d8e4ad40e9b5040ee5ea ↗
- https://git.kernel.org/stable/c/427ab81a811dab4bca9d19f82eec5847ae42646e ↗
- https://git.kernel.org/stable/c/012d37a568bfbb2c9686f03ade75560bc7139956 ↗
- https://git.kernel.org/stable/c/30aae62e50b4e074a90a9a5e15246548fbdc1182 ↗
- https://git.kernel.org/stable/c/41fe0f7b84f0cb822ae10ab08592996a592b2a25 ↗