In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
SUNRPC: reject duplicate CREDS_VALUE options<\/p>\n
gssx_dec_option_array() walks the wire-supplied option array and, for
\nevery entry whose name matches CREDS_VALUE, calls
\ngssx_dec_linux_creds() on the same struct svc_cred. That helper
\nunconditionally installs a fresh groups_alloc() result into
\ncreds->cr_group_info without releasing whatever pointer was already
\nthere:<\/p>\n
for (i = 0; i < count; i++) {
\n … decode name …
\n if (length == sizeof(CREDS_VALUE) &&
\n memcmp(p, CREDS_VALUE, sizeof(CREDS_VALUE)) == 0) {
\n err = gssx_dec_linux_creds(xdr, creds);
\n …
\n }
\n }<\/p>\n
A reply that carries two CREDS_VALUE entries therefore overwrites
\ncr_group_info on the second iteration and orphans the group_info
\nallocated by the first call. The earlier free_creds path only
\nreleases the last cr_group_info via free_svc_cred(), so the first
\nallocation's refcount stays at one and its kvmalloc-backed storage
\nis leaked. No in-tree caller of gssp_accept_sec_context_upcall()
\nexpects more than one CREDS_VALUE per reply.<\/p>\n
Fix by tracking whether a CREDS_VALUE option has already been
\ndecoded and returning -EINVAL on any subsequent match, so the
\nfree_creds path releases the single group_info that was installed.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
SUNRPC: reject duplicate CREDS_VALUE options<\/p>\n
gssx_dec_option_array() walks the wire-supplied option array and, for
\nevery entry who<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21461","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21461","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21461"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21461"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21461"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}