In the Linux kernel, the following vulnerability has been resolved: nfsd: validate sockaddr length per family in listener_set nfsd_sock_nl_policy declares NFSD_A_SOCK_ADDR as a bare NLA_BINARY attr…
Info
Summary
In the Linux kernel, the following vulnerability has been resolved: nfsd: validate sockaddr length per family in listener_set nfsd_sock_nl_policy declares NFSD_A_SOCK_ADDR as a bare NLA_BINARY attribute with no minimum length. A CAP_NET_ADMIN caller can send a 16-byte NFSD_A_SOCK_ADDR with sa_family=AF_INET6, causing a 12-byte OOB read across three consumers (rpc_cmp_addr_port, svc_find_listener, kernel_bind). nfsd_nl_listener_set_doit() also parsed and validated each listener entry inline i…
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Sources
- NVD DATABASE
Original Links
- https://git.kernel.org/stable/c/22d0e4752ca88fd84196d22ebeedc905e6540440
- https://git.kernel.org/stable/c/2aca70c18c5f5d06004122861fb151d5fcc57faf
- https://git.kernel.org/stable/c/bdcc85c2b05a9378d8bd2d65f9fc41440a3cf464
- https://git.kernel.org/stable/c/bf85a0f1e45258f90ceeec14772b5769697dfd75
Timeline
- nvd_ingest NVD