In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry<\/p>\n
svcauth_gss_decode_credbody() writes the caller’s
\nrpc_gss_wire_cred field by field and assigns gc_ctx.len only on
\nthe success tail. The caller storage is svcdata->clcred, which
\nlives in the per-svc_rqst gss_svc_data and is reused across
\nrequests. Early decode failures leave partially decoded state
\nmixed with residue from the prior request.<\/p>\n
The trailing body_len tightness check is the sharpest case:
\nxdr_stream_decode_opaque_inline() has already written gc_ctx.data
\nwith a borrowed inline pointer into the current request’s XDR
\npages, but gc_ctx.len retains its prior value. Once the request
\npages are released the pooled clcred carries a dangling pointer
\npaired with a stale length.<\/p>\n
Zero the caller’s rpc_gss_wire_cred at function entry so that
\nevery early-return path leaves a deterministic all-zero cred.
\nOn the trailing tightness-check path, gc_ctx.len is now zero
\ninstead of stale, which neuters length-driven consumers such as
\ngss_svc_searchbyctx() that would otherwise walk the dangling
\ndata pointer.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry<\/p>\n
svcauth_gss_decode_credbody() writes the caller’s
\nrpc_gss_wi<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-28471","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/28471","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=28471"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=28471"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=28471"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}