[<prev] [next>] [day] [month] [year] [list]
Message-ID: <6D896033-5E5F-4F8B-A05E-771F0408BA66@synopsys.com>
Date: Tue, 27 Jun 2017 11:33:20 +0000
From: Ari Kauppi <Ari.Kauppi@...opsys.com>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: CVE-2017-8797 Linux kernel: nfsd: remote DoS
Hi,
Linux kernel NFSv4 server is vulnerable to a remote DoS attack.
The NFSv4 server in the Linux kernel does not properly validate layout type
when processing NFSv4 pNFS LAYOUTGET operand. The provided input
value is not properly validated and is used for array dereferencing. OOPS
is triggered which leads to DoS of knfsd and eventually to soft-lockup of
whole system.
In addition, on normal processing path there is a C undefined behavior
weakness that can lead to out of bounds array dereferencing.
The attack vector requires that the attack host is within host mask of exported
NFSv4 mount or source address spoofing is not properly mitigated in the network.
The attack payload fits to single one-way UDP packet. The kernel must be
compiled with CONFIG_NFSD_PNFS enabled, which seems to be the case
with many vendor kernels.
The issue has been verified to be reproducible at least with unpatched v4.4, v4.8
and v4.11 baselines.
Upstream patches in mainline: (available in stable releases, too)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/fs/nfsd?h=v4.12-rc7&id=b550a32e60a4941994b437a8d662432a486235a5
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/fs/nfsd?h=v4.12-rc7&id=f961e3f2acae94b727380c0b74e2d3954d0edf79
The issue was found by Jani Tuovila from Synopsys Ltd with Synopsys Defensics fuzzer.
Thanks,
--
Ari Kauppi / Synopsys Ltd.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
