In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4\/6<\/p>\n
rpcb_register_inet4() and rpcb_register_inet6() store the result of
\nrpc_sockaddr2uaddr() into map->r_addr without checking it for NULL.
\nrpc_sockaddr2uaddr() returns NULL when its final kstrdup() fails, and
\nthe unchecked NULL is then carried into the synchronous RPCBPROC_SET
\nencode path: rpcb_register_call() -> rpc_call_sync() ->
\nrpcb_enc_getaddr() -> encode_rpcb_string(), whose first statement is
\nstrlen(string), dereferencing NULL and oopsing the kernel.<\/p>\n
The crash reproduces under failslab on v6.12; with KASAN the NULL
\ndereference surfaces as a fault on the shadow of address zero:<\/p>\n
Oops: general protection fault, probably for non-canonical address
\n 0xdffffc0000000000 [#1] PREEMPT SMP KASAN
\n RIP: 0010:strlen (lib\/string.c:409)
\n Call Trace:
\n encode_rpcb_string (net\/sunrpc\/rpcb_clnt.c:890)
\n rpcb_enc_getaddr (net\/sunrpc\/rpcb_clnt.c:910)
\n rpcauth_wrap_req_encode (net\/sunrpc\/auth.c:745)
\n call_encode (net\/sunrpc\/clnt.c:1966)
\n __rpc_execute (net\/sunrpc\/sched.c:952)
\n rpc_run_task (net\/sunrpc\/clnt.c:1243)
\n rpc_call_sync (net\/sunrpc\/clnt.c:1272)
\n rpcb_v4_register (net\/sunrpc\/rpcb_clnt.c:500)
\n svc_generic_rpcbind_set
\n nfsd_rpcbind_set
\n svc_register
\n svc_setup_socket
\n svc_addsock
\n write_ports
\n nfsctl_transaction_write
\n vfs_write<\/p>\n
The crash is reachable when an in-kernel RPC service (nfsd, lockd,
\nnfs-callback) registers with the local rpcbind under enough memory
\npressure for the small GFP_KERNEL kstrdup() in rpc_sockaddr2uaddr() to
\nfail. The asynchronous getport path already handles this exact failure
\nmode by returning -ENOMEM; only the two register helpers omit the check.<\/p>\n
Mirror that handling: bail out with -ENOMEM when rpc_sockaddr2uaddr()
\nreturns NULL, before the address is fed into the encoder.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4\/6<\/p>\n
rpcb_register_inet4() and rpcb_register_inet6() store the<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-24441","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/24441","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=24441"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=24441"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=24441"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}