In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
SUNRPC: harden gss_krb5_unwrap_v2 against short tokens<\/p>\n
gss_krb5_unwrap_v2() reads the EC and RRC header fields at ptr+4 and
\nptr+6 before validating that the token is at least GSS_KRB5_TOK_HDR_LEN
\n(16) bytes long, and its rotate_left() helper passes buf->len – base
\nto xdr_buf_subsegment() without verifying that base len. When
\na caller hands in a sub-16-byte token, or a token whose declared len
\nleaves base past the end of the buffer, three distinct failures follow:<\/p>\n
gss_krb5_unwrap_v2(offset, len, buf)
\n ptr = buf->head[0].iov_base + offset
\n ec = *(ptr + 4) \/* OOB read on short head *\/
\n rrc = *(ptr + 6) \/* OOB read on short head *\/
\n rotate_left(offset + 16, buf, rrc)
\n xdr_buf_subsegment(buf, &subbuf,
\n base, buf->len – base) \/* u32 wrap when base > len *\/
\n _rotate_left(&subbuf, shift)
\n shift %= buf->len \/* divide-by-zero when base == len *\/<\/p>\n
After decryption, the cleanup arithmetic has the same shape:<\/p>\n
movelen = min_t(unsigned int, buf->head[0].iov_len, len);
\n movelen -= offset + GSS_KRB5_TOK_HDR_LEN + headskip;
\n BUG_ON(offset + GSS_KRB5_TOK_HDR_LEN + headskip + movelen >
\n buf->head[0].iov_len);<\/p>\n
The BUG_ON re-adds the value just subtracted, so it reduces to
\nmin(A, B) > A and is permanently false; it cannot catch the unsigned
\nunderflow of movelen, which then drives a ~UINT_MAX-byte memmove().<\/p>\n
Add four defense-in-depth guards inside the unwrap core so it is safe
\nregardless of what its callers validate:<\/p>\n
– reject tokens with len – offset len len is zero, so the
\n shift %= buf->len modulo cannot fault;
\n – replace the dead BUG_ON with a live check that returns
\n GSS_S_DEFECTIVE_TOKEN before the movelen subtraction.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
SUNRPC: harden gss_krb5_unwrap_v2 against short tokens<\/p>\n
gss_krb5_unwrap_v2() reads the EC and RRC header fields at ptr+4 and
\nptr+6 <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21464","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21464","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21464"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21464"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21464"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}