Executive brief
The Linux kernel's NFS server (NFSD) contains a vulnerability in its XDR decoding routine that can trigger an out-of-bounds memory access. When processing NFS compound requests with invalid operation numbers, the code attempts to access memory beyond the bounds of an internal lookup table, potentially causing a kernel crash and temporary unavailability of NFS services.
Technical details
The vulnerability is a missing bounds check in the NFSD compound operation decoder. The OPDESC() macro indexes into the nfsd4_ops[] array without validating the opnum value first. The nfsd4_decode_compound() function can invoke OPDESC() with opnum set to OP_ILLEGAL (value 10044), which is far beyond the array's bounds, causing an out-of-bounds access. The fix adds a range check via nfsd4_opnum_in_range() before calling OPDESC(), and only assigns the descriptor if the opnum is valid; otherwise it leaves opdesc as NULL. The vulnerability requires network access to an NFS server and can be triggered by a malicious or malformed NFS compound request.
Affected products
- Linux Linux kernel multiple stable versions (fix applied to 4.4, 4.9, 4.14, 4.19, 5.4, 5.10, 5.15, 6.1 and later)
Timeline
- 2023-03-31: disclosed
- 2023-03-31: patched: Fix committed upstream
- 2024-06-21: other: Backported to stable kernels