Bug 1220600 (CVE-2021-46952) - VUL-0: CVE-2021-46952: kernel: NFS: fs_context: shift out-of-bounds n xprt_calc_majortimeo() due to garbage timeout option
Summary: VUL-0: CVE-2021-46952: kernel: NFS: fs_context: shift out-of-bounds n xprt_ca...
Status: RESOLVED FIXED
Alias: CVE-2021-46952
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P5 - None : Normal
Target Milestone: ---
Assignee: Kernel Bugs
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/395359/
Whiteboard: CVSSv3.1:SUSE:CVE-2021-46952:5.5:(AV:...
Keywords:
Depends on:
Blocks:
 
Reported: 2024-02-29 07:51 UTC by SMASH SMASH
Modified: 2024-02-29 07:52 UTC (History)
1 user (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description SMASH SMASH 2024-02-29 07:51:48 UTC 
In the Linux kernel, the following vulnerability has been resolved:

NFS: fs_context: validate UDP retrans to prevent shift out-of-bounds

Fix shift out-of-bounds in xprt_calc_majortimeo(). This is caused
by a garbage timeout (retrans) mount option being passed to nfs mount,
in this case from syzkaller.

If the protocol is XPRT_TRANSPORT_UDP, then 'retrans' is a shift
value for a 64-bit long integer, so 'retrans' cannot be >= 64.
If it is >= 64, fail the mount and return an error.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-46952
https://www.cve.org/CVERecord?id=CVE-2021-46952
https://git.kernel.org/stable/c/2f3380121d49e829fb73ba86240c181bc32ad897
https://git.kernel.org/stable/c/3d0163821c035040a46d816a42c0780f0f0a30a8
https://git.kernel.org/stable/c/96fa26b74cdcf9f5c98996bf36bec9fb5b19ffe2
https://git.kernel.org/stable/c/c09f11ef35955785f92369e25819bf0629df2e59
https://bugzilla.redhat.com/show_bug.cgi?id=2266510
Comment 1 Carlos López 2024-02-29 07:52:27 UTC 
Already fixed in affected branches (cve/linux-5.14, SLE15-SP6, stable and master). Closing.