[prev in list] [next in list] [prev in thread] [next in thread] 

List:       oss-security
Subject:    [oss-security] CVE-2017-8797 Linux kernel: nfsd: remote DoS
From:       Ari Kauppi <Ari.Kauppi () synopsys ! com>
Date:       2017-06-27 11:33:20
Message-ID: 6D896033-5E5F-4F8B-A05E-771F0408BA66 () synopsys ! com
[Download RAW message or body]

Hi,

Linux kernel NFSv4 server is vulnerable to a remote DoS attack.

The NFSv4 server in the Linux kernel does not properly validate layout type
when processing NFSv4 pNFS LAYOUTGET operand. The provided input
value is not properly validated and is used for array dereferencing. OOPS
is triggered which leads to DoS of knfsd and eventually to soft-lockup of
whole system.

In addition, on normal processing path there is a C undefined behavior
weakness that can lead to out of bounds array dereferencing.

The attack vector requires that the attack host is within host mask of exported
NFSv4 mount or source address spoofing is not properly mitigated in the network.
The attack payload fits to single one-way UDP packet. The kernel must be
compiled with CONFIG_NFSD_PNFS enabled, which seems to be the case
with many vendor kernels.

The issue has been verified to be reproducible at least with unpatched v4.4, v4.8
and v4.11 baselines.

Upstream patches in mainline: (available in stable releases, too)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/fs/nfsd?h=v4.12-rc7&id=b550a32e60a4941994b437a8d662432a486235a5
 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/fs/nfsd?h=v4.12-rc7&id=f961e3f2acae94b727380c0b74e2d3954d0edf79


The issue was found by Jani Tuovila from Synopsys Ltd with Synopsys Defensics fuzzer.

Thanks,

--
Ari Kauppi / Synopsys Ltd.=


[prev in list] [next in list] [prev in thread] [next in thread]