In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2<\/p>\n
gss_krb5_verify_mic_v2() reads the token ID at ptr[0..1], the flags
\nbyte at ptr[2], and padding at ptr[3..7], then passes
\nptr + GSS_KRB5_TOK_HDR_LEN and cksum_len to gss_krb5_mic_build_sg().
\nNone of these accesses check read_token->len first.<\/p>\n
The minimum safe token size is GSS_KRB5_TOK_HDR_LEN (16) plus
\nctx->krb5e->cksum_len (12-24, depending on the enctype). All callers
\naccept shorter tokens from the wire:<\/p>\n
– gss_unwrap_resp_integ() enforces only an upper bound
\n (offset + len len) before allocating
\n mic.data = kmalloc(len) and passing it to gss_verify_mic().
\n A malicious NFS server can therefore supply a short checksum
\n opaque, producing a small slab allocation that the Kerberos MIC
\n verifier reads past.<\/p>\n
– gss_validate() enforces only len = XDR_UNIT (4 bytes) before dispatching to
\n gss_verify_mic().<\/p>\n
– svcauth_gss_unwrap_integ() checks only that the checksum fits
\n in gsd->gsd_scratch.<\/p>\n
Add a length guard at the top of gss_krb5_verify_mic_v2(), before any
\nptr[] access or scatterlist construction. Well-formed MIC tokens from
\ngss_krb5_get_mic_v2() already have exactly GSS_KRB5_TOK_HDR_LEN +
\ncksum_len bytes, so valid traffic is unaffected.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2<\/p>\n
gss_krb5_verify_mic_v2() reads the token ID at ptr[0..1], the f<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21459","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21459","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21459"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21459"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21459"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}