In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
SUNRPC: harden gss_unwrap_resp_priv length checks<\/p>\n
gss_unwrap_resp_priv() validates the RPCSEC_GSS opaque length with<\/p>\n
offset = (u8 *)(p) – (u8 *)head->iov_base;
\n if (offset + opaque_len > rcv_buf->len)
\n goto unwrap_failed;
\n maj_stat = gss_unwrap(ctx->gc_gss_ctx, offset,
\n offset + opaque_len, rcv_buf);<\/p>\n
Both operands are u32 and the sum is computed in u32. A reply with
\nopaque_len near 0xffffffff makes offset + opaque_len wrap to a small
\nvalue that is below rcv_buf->len, so the bound check passes and
\ngss_unwrap() is called with end rcv_buf->len)
\n goto unwrap_failed;
\n if (opaque_len > rcv_buf->len – offset)
\n goto unwrap_failed;
\n if (opaque_len < GSS_KRB5_TOK_HDR_LEN)
\n goto unwrap_failed;<\/p>\n
The first guard makes the subtraction in the second guard
\nunconditionally safe; offset is derived from a successful
\nxdr_inline_decode() in the head kvec, so in practice it already
\nsatisfies the bound. The floor mirrors the server-side check added
\nin commit 5b757c2e57a5 ("SUNRPC: svcauth_gss: enforce krb5 token
\nminimum length").<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
SUNRPC: harden gss_unwrap_resp_priv length checks<\/p>\n
gss_unwrap_resp_priv() validates the RPCSEC_GSS opaque length with<\/p>\n
offset =<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21463","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21463","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21463"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21463"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21463"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}