Date: Tue, 27 Jun 2017 11:33:20 +0000 From: Ari Kauppi <Ari.Kauppi@...opsys.com> To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com> Subject: CVE-2017-8797 Linux kernel: nfsd: remote DoS Hi, Linux kernel NFSv4 server is vulnerable to a remote DoS attack. The NFSv4 server in the Linux kernel does not properly validate layout type when processing NFSv4 pNFS LAYOUTGET operand. The provided input value is not properly validated and is used for array dereferencing. OOPS is triggered which leads to DoS of knfsd and eventually to soft-lockup of whole system. In addition, on normal processing path there is a C undefined behavior weakness that can lead to out of bounds array dereferencing. The attack vector requires that the attack host is within host mask of exported NFSv4 mount or source address spoofing is not properly mitigated in the network. The attack payload fits to single one-way UDP packet. The kernel must be compiled with CONFIG_NFSD_PNFS enabled, which seems to be the case with many vendor kernels. The issue has been verified to be reproducible at least with unpatched v4.4, v4.8 and v4.11 baselines. Upstream patches in mainline: (available in stable releases, too) https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/fs/nfsd?h=v4.12-rc7&id=b550a32e60a4941994b437a8d662432a486235a5 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/fs/nfsd?h=v4.12-rc7&id=f961e3f2acae94b727380c0b74e2d3954d0edf79 The issue was found by Jani Tuovila from Synopsys Ltd with Synopsys Defensics fuzzer. Thanks, -- Ari Kauppi / Synopsys Ltd.
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ