In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage<\/p>\n
struct nfsd_genl_rqstp declares rq_daddr and rq_saddr as plain
\n“struct sockaddr” (16 bytes). When an IPv6 NFS client is connected,
\nnfsd_genl_rpc_status_compose_msg() casts these fields to
\n“struct sockaddr_in6 *” (28 bytes) and reads sin6_addr at offset 8..24,
\nwhich extends 8 bytes past the end of the 16-byte sockaddr field into
\nthe adjacent rq_flags member. The 16-byte nla_put_in6_addr then ships 8
\nbytes of truncated IPv6 address followed by 8 bytes of rq_flags to
\nuserspace via the NFSD_A_RPC_STATUS_SADDR6\/DADDR6 netlink attributes.<\/p>\n
This is reachable by any unprivileged process in the network namespace
\nbecause NFSD_CMD_RPC_STATUS_GET uses GENL_CMD_CAP_DUMP without
\nGENL_ADMIN_PERM.<\/p>\n
Fix by widening rq_daddr and rq_saddr to struct sockaddr_storage so the
\nIPv6 casts operate within bounds, copying sizeof(struct sockaddr_storage)
\nbytes in the memcpy calls so the full address is captured, and
\nzero-initializing the genl_rqstp stack variable to prevent leaking
\nuninitialized tail bytes through netlink.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage<\/p>\n
struct nfsd_genl_rqstp declares rq_daddr and rq_saddr as plain
\n“str<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21620","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21620","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21620"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21620"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21620"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}