In the Linux kernel, the following vulnerability has been resolved:
afs: Fix corruption in reads at fpos 2G-4G from an OpenAFS server
AFS-3 has two data fetch RPC variants, FS.FetchData and FS.FetchData64, and Linux's afs client switches between them when talking to a non-YFS server if the read size, the file position or the sum of the two have the upper 32 bits set of the 64-bit value.
This is a problem, however, since the file position and length fields of FS.FetchData are *signed* 32-bit values.
Fix this by capturing the capability bits obtained from the fileserver when it's sent an FS.GetCapabilities RPC, rather than just discarding them, and then picking out the VICED_CAPABILITY_64BITFILES flag. This can then be used to decide whether to use FS.FetchData or FS.FetchData64 - and also FS.StoreData or FS.StoreData64 - rather than using upper_32_bits() to switch on the parameter values.
This capabilities flag could also be used to limit the maximum size of the file, but all servers must be checked for that.
Note that the issue does not exist with FS.StoreData - that uses *unsigned* 32-bit values. It's also not a problem with Auristor servers as its YFS.FetchData64 op uses unsigned 64-bit values.
This can be tested by cloning a git repo through an OpenAFS client to an OpenAFS server and then doing "git status" on it from a Linux afs client[1]. Provided the clone has a pack file that's in the 2G-4G range, the git status will show errors like:
error: packfile .git/objects/pack/pack-5e813c51d12b6847bbc0fcd97c2bca66da50079c.pack does not match index error: packfile .git/objects/pack/pack-5e813c51d12b6847bbc0fcd97c2bca66da50079c.pack does not match index
This can be observed in the server's FileLog with something like the following appearing:
Sun Aug 29 19:31:39 2021 SRXAFS_FetchData, Fid = 2303380852.491776.3263114, Host 192.168.11.201:7001, Id 1001 Sun Aug 29 19:31:39 2021 CheckRights: len=0, for host=192.168.11.201:7001 Sun Aug 29 19:31:39 2021 FetchData_RXStyle: Pos 18446744071815340032, Len 3154 Sun Aug 29 19:31:39 2021 FetchData_RXStyle: file size 2400758866 ... Sun Aug 29 19:31:40 2021 SRXAFS_FetchData returns 5
Note the file position of 18446744071815340032. This is the requested file position sign-extended.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Suse | — | Upgrade kernel-azure-extraUpgrade cluster-md-kmp-rtUpgrade ocfs2-kmp-64kbUpgrade dtb-xilinxUpgrade kernel-default-develUpgrade dtb-qcomUpgrade kselftests-kmp-64kbUpgrade dtb-amlogicUpgrade kernel-macrosUpgrade kernel-default-livepatchUpgrade dtb-hisiliconUpgrade dtb-lgUpgrade kernel-source-rtUpgrade kernel-azure-livepatch-develUpgrade kernel-sourceUpgrade kernel-kvmsmall-develUpgrade kernel-azure-develUpgrade kernel-docs-htmlUpgrade kernel-64kb-optionalUpgrade kernel-zfcpdumpUpgrade dlm-kmp-64kbUpgrade gfs2-kmp-azureUpgrade reiserfs-kmp-64kbUpgrade kernel-kvmsmall-livepatch-develUpgrade dtb-broadcomUpgrade dtb-exynosUpgrade dtb-amazonUpgrade kernel-azure-optionalUpgrade kernel-develUpgrade kselftests-kmp-azureUpgrade ocfs2-kmp-rtUpgrade kernel-rtUpgrade cluster-md-kmp-azureUpgrade kernel-syms-azureUpgrade kernel-64kb-develUpgrade gfs2-kmp-rtUpgrade kernel-kvmsmall-vdsoUpgrade kernel-source-azureUpgrade kernel-debugUpgrade kernel-default-vdsoUpgrade kernel-64kb-livepatch-develUpgrade kernel-kvmsmallUpgrade kernel-rt-livepatchUpgrade kernel-devel-azureUpgrade gfs2-kmp-64kbUpgrade kernel-rt_debug-develUpgrade dtb-apmUpgrade kernel-default-extraUpgrade dtb-freescaleUpgrade dtb-allwinnerUpgrade kernel-64kbUpgrade ocfs2-kmp-defaultUpgrade dtb-alteraUpgrade kernel-obs-qaUpgrade kernel-rt-optionalUpgrade dtb-caviumUpgrade kernel-default-optionalUpgrade kernel-default-base-rebuildUpgrade kernel-symsUpgrade dtb-armUpgrade kernel-obs-buildUpgrade kernel-syms-rtUpgrade kernel-default-baseUpgrade dlm-kmp-defaultUpgrade kselftests-kmp-defaultUpgrade kernel-rt-livepatch-develUpgrade kernel-debug-develUpgrade kernel-azureUpgrade kernel-rt_debug-vdsoUpgrade dtb-appleUpgrade dlm-kmp-rtUpgrade reiserfs-kmp-azureUpgrade kernel-rt_debugUpgrade dtb-marvellUpgrade dtb-mediatekUpgrade kernel-azure-vdsoUpgrade dtb-renesasUpgrade dtb-rockchipUpgrade kernel-devel-rtUpgrade ocfs2-kmp-azureUpgrade kernel-debug-vdsoUpgrade cluster-md-kmp-64kbUpgrade kselftests-kmp-rtUpgrade kernel-64kb-extraUpgrade reiserfs-kmp-defaultUpgrade kernel-rt-vdsoUpgrade cluster-md-kmp-defaultUpgrade kernel-default-livepatch-develUpgrade kernel-rt-develUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-debug-livepatch-develUpgrade kernel-source-vanillaUpgrade kernel-docsUpgrade dtb-amdUpgrade kernel-rt-extraUpgrade kernel-defaultUpgrade gfs2-kmp-defaultUpgrade dtb-sprdUpgrade dlm-kmp-azureUpgrade dtb-nvidiaUpgrade dtb-socionextUpgrade reiserfs-kmp-rt | Aug 9, 2024 | May 21, 2024 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub