In the Linux kernel, the following vulnerability has been resolved:
orangefs: keep the readdir entry size 64-bit in fill_from_part()
fill_from_part() computes the size of a directory entry in size_t but
stores it in a __u32. An entry length near U32_MAX wraps it to a small
value, bypasses the bounds check, and is then used to index the entry,
reading far past the directory part -- an out-of-bounds read that oopses
the kernel.
Compute the size as a u64 so it cannot truncate; the bounds check then
rejects the entry. The trailer is supplied by the userspace client.
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8
AV:N - fill_from_part() parses readdir trailer bytes relayed by pvfs2-client-core from an OrangeFS/PVFS server over the cluster network; a malicious or compromised server can supply crafted directory-entry lengths that reach the kernel during getdents on HPC client nodes without local shell access.
AC:L - An entry length near U32_MAX makes padlen truncate to a small __u32, reliably bypassing the bounds check and forcing the subsequent s[len] probe; the attacker fully controls the trailer fields and no race, heap layout, or timing condition beyond readdir is required.
PR:N - A remote malicious OrangeFS/PVFS metadata server needs no account, capabilities, or namespaces on victim HPC compute nodes; once clients mount the filesystem, any process with directory read access can trigger parsing of attacker-supplied trailer bytes.
UI:N - No victim interaction is required beyond normal automated directory scans (cron, parallel job launchers, monitoring); the attacker does not need a user to mount the filesystem or click anything—only pre-existing cluster mounts to the compromised server.
S:U - The out-of-bounds read and resulting kernel oops occur entirely within the victim client's kernel address space during VFS readdir processing; there is no inherent crossing of VM, container, IOMMU, or sandbox security boundaries.
C:H - The integer truncation lets the kernel index gigabytes past the vzalloc readdir part buffer via s[len], an unbounded out-of-bounds read over adjacent kernel memory before the fault; per CNA guidance OOB reads of this class are rated High.
I:H - The bounds bypass is a memory-corruption class flaw that can reach beyond the allocated directory part into adjacent kernel heap; even though the immediate access is a read, CNA guidance rates such unchecked OOB probes as High integrity impact due to exploit chaining potential.
A:H - The maintainer confirmed the out-of-bounds read oopses the kernel; the inflated index can touch unmapped pages far outside the PART_SIZE-limited trailer buffer, causing a kernel fault, panic, or node crash on HPC clients during routine readdir.
| Attack Vector |
Network |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
None |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:N - fill_from_part() parses readdir trailer bytes relayed by pvfs2-client-core from an OrangeFS/PVFS server over the cluster network; a malicious or compromised server can supply crafted directory-entry lengths that reach the kernel during getdents on HPC client nodes without local shell access.
AC:L - An entry length near U32_MAX makes padlen truncate to a small __u32, reliably bypassing the bounds check and forcing the subsequent s[len] probe; the attacker fully controls the trailer fields and no race, heap layout, or timing condition beyond readdir is required.
PR:N - A remote malicious OrangeFS/PVFS metadata server needs no account, capabilities, or namespaces on victim HPC compute nodes; once clients mount the filesystem, any process with directory read access can trigger parsing of attacker-supplied trailer bytes.
UI:N - No victim interaction is required beyond normal automated directory scans (cron, parallel job launchers, monitoring); the attacker does not need a user to mount the filesystem or click anything—only pre-existing cluster mounts to the compromised server.
S:U - The out-of-bounds read and resulting kernel oops occur entirely within the victim client's kernel address space during VFS readdir processing; there is no inherent crossing of VM, container, IOMMU, or sandbox security boundaries.
C:H - The integer truncation lets the kernel index gigabytes past the vzalloc readdir part buffer via s[len], an unbounded out-of-bounds read over adjacent kernel memory before the fault; per CNA guidance OOB reads of this class are rated High.
I:H - The bounds bypass is a memory-corruption class flaw that can reach beyond the allocated directory part into adjacent kernel heap; even though the immediate access is a read, CNA guidance rates such unchecked OOB probes as High integrity impact due to exploit chaining potential.
A:H - The maintainer confirmed the out-of-bounds read oopses the kernel; the inflated index can touch unmapped pages far outside the PART_SIZE-limited trailer buffer, causing a kernel fault, panic, or node crash on HPC clients during routine readdir.
CVSS 3.1