In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
NFSv4.2: fix LAYOUTSTATS send buffer exhaustion<\/p>\n
encode_layoutstats_maxsz budgets XDR_QUADLEN(PNFS_LAYOUTSTATS_MAXSIZE),
\ni.e. 256 bytes, for the layoutupdate4 body written by the layout driver.
\nThe flexfiles record can exceed that.<\/p>\n
ff_layout_encode_ff_layoutupdate() emits, per data server, a netaddr4,
\nan nfs_fh4, two ff_io_latency4, an nfstime4 and a bool. A data server
\nwhose filehandle is NFS_MAXFHSIZE bytes long already accounts for 132 of
\nthose bytes, and the two ff_io_latency4 at 64 bytes each, the nfstime4
\nand the bool add a further 144, so the body passes 256 bytes before the
\nnetaddr4 is encoded at all. encode_layoutstats() additionally writes
\nthe deviceid4 and the layoutupdate4 lou_type word, neither of which the
\nmacro accounts for.<\/p>\n
The filehandle and the address are both chosen by the server, through
\nLAYOUTGET and GETDEVICEINFO, so it can drive the encoder past the
\nend of the send buffer. xdr_reserve_space() returns NULL once that
\nhappens, and the two ff_layout_encode_io_latency() calls run with
\ndss_info->mirror->lock held, so a NULL return there leaves the lock
\npermanently held.<\/p>\n
Raise PNFS_LAYOUTSTATS_MAXSIZE to 384 so that the record fits inside the
\nreservation.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
NFSv4.2: fix LAYOUTSTATS send buffer exhaustion<\/p>\n
encode_layoutstats_maxsz budgets XDR_QUADLEN(PNFS_LAYOUTSTATS_MAXSIZE),
\ni.e. 256 b<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25512","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25512","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25512"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25512"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25512"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}