Executive brief
A vulnerability in the Linux kernel's Network File System (NFS) server component could allow a user to cause a system crash or potentially execute unauthorized code. The issue occurs when the server processes a specific request to list directory contents with an invalid size parameter. This could lead to data corruption or a complete service outage on systems acting as NFS file servers.
Technical details
A buffer overflow exists in the Linux kernel's NFSD component within the init_dirlist helper functions. When a client sends a READDIR request with a very small 'count' argument (e.g., zero), the buffer size calculation `count - XDR_UNIT * 2` results in an integer underflow. This underflow is subsequently passed to XDR stream functions, leading to out-of-bounds writes via xdr_reserve_space() pointer arithmetic. The vulnerability affects NFSv2 and NFSv3 implementations following the transition to struct xdr_stream encoders. Patches have been released for stable kernel branches including 5.15.y.
Affected products
- Linux Linux Kernel 5.13 to 5.15.12
Timeline
- 2021-12-16: patched: Initial fix authored by Chuck Lever
- 2024-03-04: disclosed: CVE published in NVD