In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget<\/p>\n
The XDR buffer size calculation in nfsd4_ff_encode_layoutget() has
\nmultiple errors that can result in either an out-of-bounds write or
\nleaking uninitialized kernel memory to the client:<\/p>\n
– fh_len doesn’t account for XDR padding on the file handle data
\n – uid and gid lengths use “8 + len” but xdr_encode_opaque() actually
\n writes “4 + xdr_align_size(len)” bytes
\n – ds_len omits the flags and stats_collect_hint fields (8 bytes),
\n while len’s header constant overestimates by 8 bytes — these
\n partially cancel but leave a net mismatch<\/p>\n
The worst case occurs with short strings (e.g. uid=0, gid=0 with an
\nodd-sized file handle), where the function writes up to 5 bytes past
\nthe reserved XDR buffer. Conversely, when string lengths happen to be
\n4-byte aligned, the reservation is too large and stale buffer content
\nis sent to the client.<\/p>\n
Fix this by breaking out every encoded field explicitly in the ds_len
\ncalculation, using xdr_align_size() for all variable-length opaque
\nfields, and correcting the header constants.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget<\/p>\n
The XDR buffer size calculation in nfsd4_ff_encode_layoutget() has
\nm<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21596","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21596","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21596"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21596"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21596"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}