Executive brief
A vulnerability in the Linux kernel's Network File System (NFS) server could allow for unexpected file behavior or system instability. When a user attempts to create or modify a file with an extremely large size, the system may incorrectly handle the request, potentially leading to a denial of service. This affects systems acting as NFS servers using the NFSv3 protocol.
Technical details
A vulnerability exists in the Linux kernel's NFSD component due to improper handling of large file sizes in NFSv3 SETATTR and CREATE procedures. The root cause is in the `decode_sattr3()` function within `fs/nfsd/nfs3xdr.c`, where incoming client size values larger than `s64_max` were being silently capped using `min_t()`. This silent truncation results in the server storing a different file size than requested by the client, violating expected protocol behavior. An attacker with local access or the ability to send NFSv3 requests could exploit this to cause unexpected file states or a denial of service. The fix involves removing the silent capping to allow proper error handling (NFS3ERR_FBIG) when sizes are too large.
Affected products
- Linux Linux kernel versions up to 5.4.295; 5.5 to 5.10.220; 5.11 to 5.15.24; 5.16 to 5.16.10; 5.17-rc1 to 5.17-rc3
Timeline
- 2022-01-25: patched: Initial patch authored by Chuck Lever
- 2024-07-16: disclosed: CVE published in NVD
References
- https://git.kernel.org/stable/c/37f2d2cd8eadddbbd9c7bda327a9393399b2f89b
- https://git.kernel.org/stable/c/72c14aed6838b5d90b4dd926b6a339b34bb02e08
- https://git.kernel.org/stable/c/a231ae6bb50e7c0a9e9efd7b0d10687f1d71b3a3
- https://git.kernel.org/stable/c/a648fdeb7c0e17177a2280344d015dba3fbe3314
- https://git.kernel.org/stable/c/aa9051ddb4b378bd22e72a67bc77b9fc1482c5f0
- https://cert-portal.siemens.com/productcert/html/ssa-265688.html
- https://cert-portal.siemens.com/productcert/html/ssa-355557.html