Executive brief
A vulnerability in the Linux kernel's Network File System (NFS) server could allow a local user to cause a system malfunction. By sending a specially crafted file size value that exceeds the system's handling capacity, an attacker can trigger an internal error. This primarily impacts the availability of the system, potentially leading to a denial-of-service condition.
Technical details
An integer underflow vulnerability exists in the Linux kernel's NFSD component within the nfsd_setattr() function. The issue stems from a type mismatch where NFSv3 and NFSv4 define file sizes as unsigned 64-bit integers, but the kernel's internal iattr::ia_size (loff_t) is a signed 64-bit integer. When decode_fattr4() or similar functions process a value larger than S64_MAX, it results in a negative value in ia_size. An attacker with local access can exploit this by sending malformed NFS requests to trigger unexpected behavior or a denial of service. The fix involves validating that ia_size is not negative in the common nfsd_setattr() path and returning an EFBIG error if it is.
Affected products
- Linux Linux Kernel versions up to 5.4.295; 5.5 to 5.10.220; 5.11 to 5.15.24; 5.16 to 5.16.10; 5.17-rc1 to 5.17-rc3
Timeline
- 2022-01-31: other: Patch authored
- 2024-07-16: advisory: NVD published date
References
- https://git.kernel.org/stable/c/38d02ba22e43b6fc7d291cf724bc6e3b7be6626b
- https://git.kernel.org/stable/c/8e0ecaf7a7e57b30284d6b3289cc436100fadc48
- https://git.kernel.org/stable/c/d2211e6e34d0755f35e2f8c22d81999fa81cfc71
- https://git.kernel.org/stable/c/da22ca1ad548429d7822011c54cfe210718e0aa7
- https://git.kernel.org/stable/c/e6faac3f58c7c4176b66f63def17a34232a17b0e
- https://cert-portal.siemens.com/productcert/html/ssa-265688.html
- https://cert-portal.siemens.com/productcert/html/ssa-355557.html