In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
NFSD: Fix SECINFO_NO_NAME decode error cleanup<\/p>\n
nfsd4_decode_secinfo_no_name() currently initializes sin_exp after
\ndecoding sin_style. If the XDR stream is truncated, the decoder returns
\nnfserr_bad_xdr before sin_exp is initialized.<\/p>\n
Since commit 3fdc54646234 (“NFSD: Reduce amount of struct
\nnfsd4_compoundargs that needs clearing”), the inline iops array is not
\ncleared between RPC calls. A failed SECINFO_NO_NAME decode can therefore
\nleave sin_exp holding stale union contents from a previous operation.<\/p>\n
The error response path still invokes nfsd4_secinfo_no_name_release(),
\nwhich calls exp_put() on a non-NULL sin_exp.<\/p>\n
Initialize sin_exp before the first failable decode step, matching
\nnfsd4_decode_secinfo().<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
NFSD: Fix SECINFO_NO_NAME decode error cleanup<\/p>\n
nfsd4_decode_secinfo_no_name() currently initializes sin_exp after
\ndecoding sin_sty<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-14866","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/14866","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=14866"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=14866"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=14866"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}