In the Linux kernel, the following vulnerability has been resolved:
NFSD: Fix READDIR buffer overflow
If a client sends a READDIR count argument that is too small (say, zero), then the buffer size calculation in the new init_dirlist helper functions results in an underflow, allowing the XDR stream functions to write beyond the actual buffer.
This calculation has always been suspect. NFSD has never sanity- checked the READDIR count argument, but the old entry encoders managed the problem correctly.
With the commits below, entry encoding changed, exposing the underflow to the pointer arithmetic in xdr_reserve_space().
Modern NFS clients attempt to retrieve as much data as possible for each READDIR request. Also, we have no unit tests that exercise the behavior of READDIR at the lower bound of @count values. Thus this case was missed during testing.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | Mar 4, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Mar 4, 2024 |
| Suse | — | Upgrade kernel-macrosUpgrade kernel-develUpgrade kernel-64kb-develUpgrade kernel-rt_debug-vdsoUpgrade kernel-syms-azureUpgrade kernel-kvmsmallUpgrade kernel-devel-rtUpgrade kernel-debug-livepatch-develUpgrade kernel-rt-develUpgrade reiserfs-kmp-defaultUpgrade kernel-symsUpgrade reiserfs-kmp-rtUpgrade kernel-debugUpgrade kernel-64kb-optionalUpgrade cluster-md-kmp-defaultUpgrade kernel-64kb-livepatch-develUpgrade kernel-azure-livepatch-develUpgrade dtb-hisiliconUpgrade kernel-devel-azureUpgrade kernel-kvmsmall-develUpgrade dlm-kmp-azureUpgrade kselftests-kmp-rtUpgrade ocfs2-kmp-rtUpgrade dtb-socionextUpgrade dtb-xilinxUpgrade kernel-default-extraUpgrade kernel-zfcpdumpUpgrade gfs2-kmp-rtUpgrade cluster-md-kmp-azureUpgrade dtb-qcomUpgrade dtb-amdUpgrade reiserfs-kmp-azureUpgrade kernel-rt-livepatch-develUpgrade kernel-docsUpgrade dtb-armUpgrade kernel-rt-livepatchUpgrade kselftests-kmp-defaultUpgrade gfs2-kmp-64kbUpgrade dlm-kmp-defaultUpgrade dtb-apmUpgrade kernel-debug-develUpgrade dtb-rockchipUpgrade kernel-obs-qaUpgrade dtb-mediatekUpgrade dtb-amlogicUpgrade kernel-syms-rtUpgrade kernel-azure-vdsoUpgrade kernel-default-optionalUpgrade kernel-defaultUpgrade kernel-rt_debug-livepatch-develUpgrade ocfs2-kmp-azureUpgrade kernel-rt-optionalUpgrade kernel-rt-extraUpgrade kernel-debug-vdsoUpgrade kernel-kvmsmall-vdsoUpgrade reiserfs-kmp-64kbUpgrade kernel-default-livepatchUpgrade kernel-rt-vdsoUpgrade gfs2-kmp-azureUpgrade cluster-md-kmp-64kbUpgrade kernel-64kb-extraUpgrade kselftests-kmp-azureUpgrade dtb-sprdUpgrade dtb-alteraUpgrade dtb-caviumUpgrade kernel-azure-develUpgrade dtb-renesasUpgrade kernel-azure-optionalUpgrade dlm-kmp-64kbUpgrade dtb-marvellUpgrade kernel-64kbUpgrade kernel-docs-htmlUpgrade ocfs2-kmp-64kbUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-rtUpgrade kernel-obs-buildUpgrade kernel-default-baseUpgrade kselftests-kmp-64kbUpgrade cluster-md-kmp-rtUpgrade kernel-source-azureUpgrade dtb-broadcomUpgrade kernel-sourceUpgrade dtb-exynosUpgrade dtb-lgUpgrade gfs2-kmp-defaultUpgrade dtb-nvidiaUpgrade kernel-default-livepatch-develUpgrade dlm-kmp-rtUpgrade dtb-amazonUpgrade kernel-rt_debug-develUpgrade dtb-allwinnerUpgrade kernel-azureUpgrade kernel-azure-extraUpgrade kernel-source-vanillaUpgrade dtb-freescaleUpgrade ocfs2-kmp-defaultUpgrade kernel-source-rtUpgrade kernel-default-base-rebuildUpgrade dtb-appleUpgrade kernel-default-vdsoUpgrade kernel-default-develUpgrade kernel-rt_debug | Aug 9, 2024 | Mar 4, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub