Description
In the Linux kernel, the following vulnerability has been resolved: nfsd: validate symlink target length in NFSv4 CREATE nfsd4_decode_create() accepts an unbounded cr_datalen from the wire for NF4LNK symlink targets, allowing a client to force a kmalloc of up to the maximum RPC payload size (several MiB) per COMPOUND op that persists until compound teardown. The VFS rejects oversized targets with ENAMETOOLONG, but the allocation has already occurred. Reject cr_datalen == 0 early with nfserr_inval and cr_datalen greater than NFS4_MAXPATHLEN (PATH_MAX) with nfserr_nametoolong to bound the allocation.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 36011308b3f01ce7dc9954f3cefcbb5291af9f95affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 888dad4b557352cf85be31613407b5ba51ad07d1affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 8661d3cb38fd148947e57dbc0871fd4d3fa33bbfaffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 3ef5e7a01a4d74995a65496bc9166d1e980a4355affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < b24843ea3de1676b29902457b38507c95a80649baffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 895a485cd3758031ef9993c0d53cf19ce8fb4cccaffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 45ec115cbfecb4b3cfab7fca6f73d1b60696a25aaffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 041f57056e5fb9c80adc088269322d2c61074406affected
Linux Linux
Default version status: affected
2.6.12affected0 to < 2.6.12unaffected5.10.270 to ≤ 5.10.*unaffected5.15.221 to ≤ 5.15.*unaffected6.1.188 to ≤ 6.1.*unaffected6.6.157 to ≤ 6.6.*unaffected6.12.109 to ≤ 6.12.*unaffected6.18.50 to ≤ 6.18.*unaffected7.2.4 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/36011308b3f01ce7dc9954f3cefcbb5291af9f95 ↗
- https://git.kernel.org/stable/c/888dad4b557352cf85be31613407b5ba51ad07d1 ↗
- https://git.kernel.org/stable/c/8661d3cb38fd148947e57dbc0871fd4d3fa33bbf ↗
- https://git.kernel.org/stable/c/3ef5e7a01a4d74995a65496bc9166d1e980a4355 ↗
- https://git.kernel.org/stable/c/b24843ea3de1676b29902457b38507c95a80649b ↗
- https://git.kernel.org/stable/c/895a485cd3758031ef9993c0d53cf19ce8fb4ccc ↗
- https://git.kernel.org/stable/c/45ec115cbfecb4b3cfab7fca6f73d1b60696a25a ↗
- https://git.kernel.org/stable/c/041f57056e5fb9c80adc088269322d2c61074406 ↗