Executive brief
A vulnerability in the Linux kernel's Network File System (NFS) implementation could allow a local user to crash the system. The issue occurs when the system incorrectly handles requests to list extended file attributes, leading to a kernel panic. This primarily impacts the availability of the affected server or workstation.
Technical details
A vulnerability in NFSv4.2 within the Linux kernel can trigger a 'kernel BUG' at mm/usercopy.c:102. The issue arises in nfs4_listxattr() when a call is made with a buffer size greater than zero, but preceding calls to generic_listxattr() or nfs4_listxattr_nfs4_label() consume the entire buffer. This results in a zero-size buffer being passed to nfs4_listxattr_nfs4_user(), triggering a usercopy abort and subsequent kernel panic (Oops). An attacker with local access can exploit this to cause a Denial of Service (DoS). The fix introduces a check to return an ERANGE error if the required buffer size exceeds the provided size.
Affected products
- Linux Linux Kernel 5.9 to 5.10.213, 5.11 to 5.15.152, 5.16 to 6.1.82, 6.2 to 6.6.22, 6.7 to 6.7.10, 6.8 to 6.8.1
Timeline
- 2024-04-17: advisory
- 2024-02-28: patched: Initial fix in mainline kernel commit 251a658bbfceafb4d58c76b77682c8bf7bcfad65
References
- https://git.kernel.org/stable/c/06e828b3f1b206de08ef520fc46a40b22e1869cb
- https://git.kernel.org/stable/c/23bfecb4d852751d5e403557dd500bb563313baf
- https://git.kernel.org/stable/c/251a658bbfceafb4d58c76b77682c8bf7bcfad65
- https://git.kernel.org/stable/c/4403438eaca6e91f02d272211c4d6b045092396b
- https://git.kernel.org/stable/c/79cdcc765969d23f4e3d6ea115660c3333498768
- https://git.kernel.org/stable/c/80365c9f96015bbf048fdd6c8705d3f8770132bf
- https://git.kernel.org/stable/c/9d52865ff28245fc2134da9f99baff603a24407a