In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nfsd: cap decoded POSIX ACL count to bound sort cost<\/p>\n
nfsd4_decode_posixacl() reads a u32 entry count off the wire and passes
\nit straight to posix_acl_alloc() and sort_pacl_range(). The latter is
\nan O(n^2) bubble sort, so a client-chosen count drives unbounded CPU in
\nthe server’s compound processing path.<\/p>\n
nfsd4_decode_posixacl()
\n xdr_stream_decode_u32(&count) \/* uncapped u32 *\/
\n posix_acl_alloc(count, GFP_KERNEL)
\n sort_pacl_range(*acl, 0, count – 1) \/* O(n^2) bubble sort *\/<\/p>\n
The encoder side in the same file already rejects ACLs whose a_count
\nexceeds NFS_ACL_MAX_ENTRIES, but the decoder introduced in commit
\n5fc51dfc2eb1 (“NFSD: Add support for XDR decoding POSIX draft ACLs”)
\nomitted the symmetric check.<\/p>\n
Fix by rejecting a wire count greater than NFS_ACL_MAX_ENTRIES with
\nnfserr_inval, before any allocation, so the sort is bounded by
\nNFS_ACL_MAX_ENTRIES^2 comparisons.<\/p>\n
While we’re in here, also fix the nfserr_resource return if
\nposix_acl_alloc() fails. That’s not a legal error code for v4.1+. Change
\nit to return nfserr_jukebox as that’s more appropriate for memory
\nallocation failures.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nfsd: cap decoded POSIX ACL count to bound sort cost<\/p>\n
nfsd4_decode_posixacl() reads a u32 entry count off the wire and passes
\nit st<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21617","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21617","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21617"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21617"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21617"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}