In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nfsd: reject out-of-range useconds in NFSv2 SETATTR\/CREATE<\/p>\n
The NFSv2 sattr decoder converts the wire useconds to nanoseconds in
\nsvcxdr_decode_sattr():<\/p>\n
\tiap->ia_atime.tv_nsec = tmp2 * NSEC_PER_USEC;<\/p>\n
tmp2 is a u32 and NSEC_PER_USEC is 1000, so the product is computed in
\nunsigned long. On ILP32 that is 32 bits, and an out-of-range useconds
\nvalue such as 4294968 wraps to tv_nsec == 704. The corruption therefore
\nhappens during decode, before any proc function can inspect the value,
\nand a later range check on tv_nsec would see an in-range result and
\naccept it. Rejecting in the decoder yields an RPC GARBAGE_ARGS reply.
\nNFSv2 defines no NFSERR_INVAL, so there is no NFS-level status to return
\nfor a malformed time argument, and the check cannot move to the proc
\nfunction the way the v3\/v4 nsec range checks do.<\/p>\n
Guard the raw useconds before the multiplication and reject values
\ngreater than 1000000. useconds == 1000000 is kept: it is the Sun
\nconvention for “set to the current server time”, and the in-tree Linux
\nNFSv2 client emits it in both the atime and the mtime field for a plain
\ntouch \/ utimes(file, NULL) (see encode_sattr() and
\nxdr_encode_current_server_time() in fs\/nfs\/nfs2xdr.c). Rejecting 1000000
\nwould turn that common operation into a hard decode failure for both
\nSETATTR and CREATE. 1000000 * NSEC_PER_USEC is 10^9, which does not wrap
\non ILP32, so the Sun convention value passes through safely. Only
\ngenuinely out-of-range values (> 1000000) are rejected. The atime and
\nmtime guards are therefore symmetric.<\/p>\n
The decoder only applied the Sun convention in the mtime block, which
\nclears ATTR_ATIME_SET|ATTR_MTIME_SET when mtime useconds == 1000000. If a
\nclient puts 1000000 in the atime field but not in the mtime field, the
\natime block stored an out-of-range tv_nsec (10^9) and left ATTR_ATIME_SET
\nset, so the bogus value reached the filesystem. Apply the convention in
\nthe atime block as well, clearing ATTR_ATIME_SET so the server uses its
\ncurrent time and ignores the value. Only ATTR_ATIME_SET is cleared there.
\nThe mtime block keeps its existing behavior, where 1000000 means “set
\nboth atime and mtime to now”.<\/p>\n
[ cel: various tweaks, addenda, and clean-ups ]<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nfsd: reject out-of-range useconds in NFSv2 SETATTR\/CREATE<\/p>\n
The NFSv2 sattr decoder converts the wire useconds to nanoseconds in
\nsv<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21587","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21587","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21587"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21587"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21587"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}