In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow<\/p>\n
xdr_buf_trim() trims `len` bytes from the tail of an xdr_buf by
\nwalking the tail, pages, and head iovecs. Each per-section step
\nuses min_t() so it never removes more bytes than that section
\nholds, but the final accounting at the fix_len label subtracts the
\ntotal bytes actually consumed from buf->len without any clamp:<\/p>\n
fix_len:
\n buf->len -= (len – trim);<\/p>\n
When the caller has set buf->len to a value smaller than the sum
\nof the iov_lens, (len – trim) can exceed buf->len and the unsigned
\nsubtraction wraps to near UINT_MAX. gss_krb5_unwrap_v2() reaches
\nxdr_buf_trim() in exactly that state:<\/p>\n
buf->head[0].iov_len -= GSS_KRB5_TOK_HDR_LEN + headskip;
\n buf->len = len – (GSS_KRB5_TOK_HDR_LEN + headskip);
\n xdr_buf_trim(buf, ec + GSS_KRB5_TOK_HDR_LEN + tailskip);<\/p>\n
buf->len is a small wire-derived value while the iov_lens are at
\npage scale, so the per-section loops legitimately consume far more
\nbytes than buf->len records. The wrapped buf->len then propagates
\nas the authoritative stream bound into every downstream XDR
\ndecoder.<\/p>\n
Fix by clamping the decrement so buf->len bottoms out at zero:<\/p>\n
buf->len -= min_t(unsigned int, buf->len, len – trim);<\/p>\n
On the normal path where the iov_lens sum to buf->len, (len – trim)
\nis always len and the result is identical to before. No
\ncallers change behavior outside the underflow case.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow<\/p>\n
xdr_buf_trim() trims `len` bytes from the tail of an xdr_buf by
\nwalking th<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21473","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21473","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21473"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21473"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21473"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}