In the Linux kernel, the following vulnerability has been resolved:
svcrdma: Fix offset arithmetic in read_chunk_range
svc_rdma_read_chunk_range() walks a Read chunk's segment list to
build a sub-range starting at byte offset and spanning length bytes
for a Position-Zero or Call chunk. Two arithmetic defects in the
per-segment loop produce wrong DMA lengths and a u32 underflow:
<pre>
pcl_for_each_segment(segment, chunk) {
if (offset > segment->rs_length) {
offset -= segment->rs_length;
continue;
}
dummy.rs_handle = segment->rs_handle;
dummy.rs_length = min_t(u32, length,
segment->rs_length) - offset;
dummy.rs_offset = segment->rs_offset + offset;
</pre>
First, the skip predicate uses '>' instead of '>='. When offset
equals the segment's full rs_length, the segment is fully consumed
and should be skipped, but the loop falls through into the body.
The resulting dummy.rs_length is min_t(u32, length, rs_length) -
rs_length, which underflows to a near-UINT_MAX u32 when length is
smaller than rs_length, or is zero otherwise.
Second, the length formula subtracts offset from the min_t() result
rather than from segment->rs_length before the cap. For offset > 0
the segment's residual is rs_length - offset, not rs_length, so the
cap must be applied to the residual. With the current bracketing,
whenever length is smaller than rs_length - offset the per-segment
length becomes length - offset instead of length, silently dropping
offset bytes from the rebuilt chunk. Combined with the boundary
case above it also enables the u32 underflow path, which propagates
a huge nr_bvec into svc_rdma_build_read_segment() and a multi-MiB
kmalloc_array_node() in svc_rdma_get_rw_ctxt().
Additionally, svc_rdma_read_call_chunk() can invoke this function
with length == 0 when the last Read chunk ends exactly at the end
of the Call chunk. With the corrected >= predicate, every segment
is skipped and the function returns the initial -EINVAL, rejecting
a valid request. Return success immediately when length is zero.
Also break out of the loop once length is fully consumed to avoid
passing zero-length segments to svc_rdma_build_read_segment().
Fix by using '>=' so a fully-consumed segment is skipped, by
moving '- offset' inside min_t() so the cap is applied to the
segment's residual length, by returning success for zero-length
requests, and by stopping iteration when the requested range has
been consumed.
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8
AV:N - svcrdma is nfsd's RPC-over-RDMA server transport; a remote peer reaches svc_rdma_read_chunk_range() by sending a Call with a Position-Zero/Call chunk and Read list over routable iWARP or RoCEv2, matching prior kernel CNA scores for this subsystem.
AC:L - The attacker fully controls Call-chunk segment lengths and Read-chunk positions and can place a Read chunk on a segment boundary with a smaller remaining range so dummy.rs_length underflows a u32 deterministically, with no race or uncontrollable layout.
PR:N - svc_rdma_process_read_list() runs in svc_rdma_recvfrom() while assembling the transport message, before svc_process() performs RPC or NFS authentication, and RDMA CM accept has no credential check.
UI:N - Sending a crafted RPC-over-RDMA message with a malicious Call chunk and Read list to an already-listening NFS/RDMA service is sufficient; no victim mount, click, or other user action is required.
S:U - The vulnerable NFS/RDMA service and affected kernel memory belong to the same host kernel security authority; this is not a VM, IOMMU, or sandbox escape.
C:H - The underflowed length is added to rc_readbytes and, when Reads complete, svc_rdma_read_complete_pzrc() sets xdr_buf.page_len to a near-4GiB value, so XDR walks far past the rq_pages allocation and reads adjacent kernel heap as page pointers.
I:H - XDR helpers such as xdr_buf_pages_zero() kmap and memset through that inflated page_len, writing via out-of-bounds page pointers taken from adjacent slab, a kernel integrity and control-flow hijack primitive.
A:H - On the scatterlist path PAGE_ALIGN wrapping to 0 hits sg_alloc_table_chained(0) which BUG_ON(!nents) and panics; the huge page_len walk oopses on invalid pages, and an unauthenticated peer can repeat this per request.
| Attack Vector |
Network |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
None |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:N - svcrdma is nfsd's RPC-over-RDMA server transport; a remote peer reaches svc_rdma_read_chunk_range() by sending a Call with a Position-Zero/Call chunk and Read list over routable iWARP or RoCEv2, matching prior kernel CNA scores for this subsystem.
AC:L - The attacker fully controls Call-chunk segment lengths and Read-chunk positions and can place a Read chunk on a segment boundary with a smaller remaining range so dummy.rs_length underflows a u32 deterministically, with no race or uncontrollable layout.
PR:N - svc_rdma_process_read_list() runs in svc_rdma_recvfrom() while assembling the transport message, before svc_process() performs RPC or NFS authentication, and RDMA CM accept has no credential check.
UI:N - Sending a crafted RPC-over-RDMA message with a malicious Call chunk and Read list to an already-listening NFS/RDMA service is sufficient; no victim mount, click, or other user action is required.
S:U - The vulnerable NFS/RDMA service and affected kernel memory belong to the same host kernel security authority; this is not a VM, IOMMU, or sandbox escape.
C:H - The underflowed length is added to rc_readbytes and, when Reads complete, svc_rdma_read_complete_pzrc() sets xdr_buf.page_len to a near-4GiB value, so XDR walks far past the rq_pages allocation and reads adjacent kernel heap as page pointers.
I:H - XDR helpers such as xdr_buf_pages_zero() kmap and memset through that inflated page_len, writing via out-of-bounds page pointers taken from adjacent slab, a kernel integrity and control-flow hijack primitive.
A:H - On the scatterlist path PAGE_ALIGN wrapping to 0 hits sg_alloc_table_chained(0) which BUG_ON(!nents) and panics; the huge page_len walk oopses on invalid pages, and an unauthenticated peer can repeat this per request.
CVSS 3.1