Description
In the Linux kernel, the following vulnerability has been resolved: nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage struct nfsd_genl_rqstp declares rq_daddr and rq_saddr as plain "struct sockaddr" (16 bytes). When an IPv6 NFS client is connected, nfsd_genl_rpc_status_compose_msg() casts these fields to "struct sockaddr_in6 *" (28 bytes) and reads sin6_addr at offset 8..24, which extends 8 bytes past the end of the 16-byte sockaddr field into the adjacent rq_flags member. The 16-byte nla_put_in6_addr then ships 8 bytes of truncated IPv6 address followed by 8 bytes of rq_flags to userspace via the NFSD_A_RPC_STATUS_SADDR6/DADDR6 netlink attributes. This is reachable by any unprivileged process in the network namespace because NFSD_CMD_RPC_STATUS_GET uses GENL_CMD_CAP_DUMP without GENL_ADMIN_PERM. Fix by widening rq_daddr and rq_saddr to struct sockaddr_storage so the IPv6 casts operate within bounds, copying sizeof(struct sockaddr_storage) bytes in the memcpy calls so the full address is captured, and zero-initializing the genl_rqstp stack variable to prevent leaking uninitialized tail bytes through netlink.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
bd9d6a3efa9709e653aafbeb859289feccb8e70c to < 9a2e791639a1c5cac3f219b0d2632835d8f88d27affectedbd9d6a3efa9709e653aafbeb859289feccb8e70c to < 03c512f22d3fbe7a3767d6df5e3d88b8e7c105e5affectedbd9d6a3efa9709e653aafbeb859289feccb8e70c to < dcb69ad0dafb4a24b825183bb94055d5be8a10bdaffectedbd9d6a3efa9709e653aafbeb859289feccb8e70c to < a99d720ed2a5258564e5e9d5f39f3184a030d354affected
Linux Linux
Default version status: affected
6.7affected0 to < 6.7unaffected6.12.111 to ≤ 6.12.*unaffected6.18.51 to ≤ 6.18.*unaffected7.2.4 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected