Skip to content
CVE PROGRAM SOURCE RECORD9.1 Critical

CVE-2026-89537

SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 gss_krb5_verify_mic_v2() reads the token ID at ptr[0..1], the flags byte at ptr[2], and padding at ptr[3..7], then passes ptr + GSS_KRB5_TOK_HDR_LEN and cksum_len to gss_krb5_mic_build_sg(). None of these accesses check read_token->len first. The minimum safe token size is GSS_KRB5_TOK_HDR_LEN (16) plus ctx->krb5e->cksum_len (12-24, depending on the enctype). All callers accept shorter tokens from the wire: - gss_unwrap_resp_integ() enforces only an upper bound (offset + len <= rcv_buf->len) before allocating mic.data = kmalloc(len) and passing it to gss_verify_mic(). A malicious NFS server can therefore supply a short checksum opaque, producing a small slab allocation that the Kerberos MIC verifier reads past. - gss_validate() enforces only len <= RPC_MAX_AUTH_SIZE (400) before passing the wire-supplied length to gss_validate_seqno_mic(), which constructs a mic xdr_netobj and calls gss_verify_mic(). - svcauth_gss_verify_header() enforces only checksum.len >= XDR_UNIT (4 bytes) before dispatching to gss_verify_mic(). - svcauth_gss_unwrap_integ() checks only that the checksum fits in gsd->gsd_scratch. Add a length guard at the top of gss_krb5_verify_mic_v2(), before any ptr[] access or scatterlist construction. Well-formed MIC tokens from gss_krb5_get_mic_v2() already have exactly GSS_KRB5_TOK_HDR_LEN + cksum_len bytes, so valid traffic is unaffected.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • de9c17eb4a912c9028f7b470eb80815144883b26 to < 86c3d527303ec79805098bda3dfc4fa994757f59affected
  • de9c17eb4a912c9028f7b470eb80815144883b26 to < b2e9e10f5a536befcdce64d3e6946dff42fb823eaffected
  • de9c17eb4a912c9028f7b470eb80815144883b26 to < 997577c52487181226775db3755079a3ba1d52b9affected
  • de9c17eb4a912c9028f7b470eb80815144883b26 to < 996dd15f60121bdd7896b4554458f8806d608063affected
  • de9c17eb4a912c9028f7b470eb80815144883b26 to < 7a946b2e7207f968902f2147ab9b30726f82f7abaffected
  • de9c17eb4a912c9028f7b470eb80815144883b26 to < b94f6719dcd9f7a609bc5f459f85795900e77d25affected

Linux Linux

Default version status: affected

  • 2.6.35affected
  • 0 to < 2.6.35unaffected
  • 6.1.191 to ≤ 6.1.*unaffected
  • 6.6.160 to ≤ 6.6.*unaffected
  • 6.12.114 to ≤ 6.12.*unaffected
  • 6.18.57 to ≤ 6.18.*unaffected
  • 7.2.4 to ≤ 7.2.*unaffected
  • 7.3 to ≤ *unaffected

References