In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops<\/p>\n
A client can send an NFSv3 SETATTR, CREATE, MKDIR, SYMLINK or MKNOD
\ncarrying an atime or mtime whose nseconds field is out of range. The
\nvalue is well-formed on the wire and decodes cleanly into a valid
\nuint32, but it is not a valid timespec64: tv_nsec must be less than
\nNSEC_PER_SEC.<\/p>\n
Nothing in the setattr path clamps it. notify_change() runs the time
\nthrough timestamp_truncate(), which does not reduce tv_nsec below
\nNSEC_PER_SEC when the filesystem supports nanosecond granularity
\n(s_time_gran == 1), and the inode atime\/mtime setters store it verbatim
\n(only ctime is normalized, via inode_set_ctime_to_ts()). The
\nun-normalized value then corrupts on-disk metadata: ext4’s
\next4_encode_extra_time() shifts tv_nsec left by EXT4_EPOCH_BITS, which
\noverflows the 32-bit extra field and clobbers the seconds-epoch bits, so
\nthe stored seconds (and thus the year) are wrong on read-back. XFS with
\nbigtime mis-stores the timestamp for the same reason.<\/p>\n
Validate the client-supplied atime\/mtime in the proc handlers and return
\nNFS3ERR_INVAL before anything is changed. RFC 1813 lists NFS3ERR_INVAL
\nfor SETATTR and describes it as the error for a value the server ‘can
\nnot store … in its own representation’; the client maps it to EINVAL.<\/p>\n
Checking in the proc handlers, rather than in nfsd_setattr(), keeps the
\nrejection in front of object creation. The create operations create the
\nobject before nfsd_create_setattr() runs, so a late failure would leave
\nthe new object behind and turn a non-idempotent request into a namespace
\nchange that reports failure. The check is therefore done up front, for
\nthe create operations before the object is created.<\/p>\n
tv_nsec is a long, so the comparison casts it to unsigned long (the same
\nwidth) rather than to u32, matching timespec64_valid(). A u32 cast would
\ntruncate on 64-bit; the unsigned long cast also rejects a value that
\nbecame negative when an out-of-range u32 wire nseconds was assigned to a
\n32-bit long.<\/p>\n
Only client-supplied times are checked: SET_TO_SERVER_TIME requests
\ncarry no client value. The sattrguard3 ctime is deliberately left alone:
\nan out-of-range guard simply never matches the object’s ctime and yields
\nNFS3ERR_NOT_SYNC via the existing guardtime comparison, which is the
\nprotocol-correct outcome rather than rejecting the request.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops<\/p>\n
A client can send an NFSv3 SETATTR, CREATE, MKDIR, SYMLINK or M<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21588","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21588","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21588"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21588"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21588"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}