In the Linux kernel, the following vulnerability has been resolved:
nfsd: size fh_verify server sockaddr slot by xpt_locallen
The nfsd_fh_verify and nfsd_fh_verify_err tracepoints declare the
server sockaddr slot sized by xpt_remotelen but fill it from
xpt_local using xpt_locallen:
<pre>
TP_STRUCT__entry(
...
__sockaddr(server, rqstp->rq_xprt->xpt_remotelen)
...
)
TP_fast_assign(
...
__assign_sockaddr(server, &rqstp->rq_xprt->xpt_local,
rqstp->rq_xprt->xpt_locallen);
...
)
</pre>
When xpt_locallen exceeds xpt_remotelen, __assign_sockaddr's memcpy
writes past the reserved ring-buffer slot. In the reverse direction
(xpt_locallen < xpt_remotelen) the slot is oversized and the
unwritten tail leaks prior ring-buffer contents to trace consumers.
The write-past-end case is reachable on NFS/UDP. svc_xprt_set_remote()
is only called from svc_tcp_accept() (net/sunrpc/svcsock.c) and from
the RDMA connect path; svc_create_socket() for UDP calls only
svc_xprt_set_local(), so xpt_remotelen stays 0 for the xprt's
lifetime. Every fh_verify trace for an NFSv2/v3-over-UDP request
then copies 16 or 28 bytes from xpt_local into a zero-byte slot.
The other NFSD tracepoints that record the server address
(NFSD_TRACE_PROC_CALL_FIELDS, NFSD_TRACE_PROC_RES_FIELDS,
SVC_RQST_ENDPOINT_FIELDS) already size the server slot by
xpt_locallen; nfsd_fh_verify and nfsd_fh_verify_err were the only
exceptions.
Fix by sizing the server slot with xpt_locallen so the declared slot
matches the copy length. The client slot and its assignment already
agree on xpt_remotelen and are left untouched.
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8
AV:N - The nfsd_fh_verify and nfsd_fh_verify_err tracepoints run in the in-kernel NFS server while handling NFSv2/v3 RPCs on UDP/2049; a remote packet reaches svc_udp_recvfrom, svc_process, nfsd_proc_getattr/nfsd3_proc_getattr, then fh_verify.
AC:L - With the nfsd_fh_verify events enabled (a realistic nfsd tracing/perf deployment), every UDP fh_verify deterministically memcpy's 16 or 28 bytes of xpt_local into a 0-byte slot; no race, layout guess, or attacker-uncontrollable condition is required.
PR:N - AUTH_NULL and AUTH_SYS verify no credentials, and GETATTR uses NFSD_MAY_NOP so a dummy filehandle still hits fh_verify (and nfsd_fh_verify_err on lookup failure); a UDP source-IP spoof or wildcard export satisfies the IP map without an authenticated principal.
UI:N - The attacker sends crafted NFS/UDP RPCs unilaterally; no administrator or victim-client action is required at exploitation time, and tracing already being enabled is the scored configuration rather than user interaction.
S:U - The overflow corrupts the host kernel's ftrace/perf ring buffer inside the NFS server's own kernel security authority and does not cross a VM, IOMMU, or sandbox boundary.
C:H - When the reserved sockaddr slot is larger than xpt_locallen, leftover prior ring-buffer contents including kernel pointers from other events leak to trace consumers; the UDP out-of-bounds write can also corrupt adjacent event headers so later parses treat neighbouring kernel memory as payload.
I:H - On NFS/UDP, xpt_remotelen stays 0 so __assign_sockaddr copies 16 or 28 bytes of xpt_local past the reserved dynamic array into subsequent ring-buffer bytes and potentially the next sub-buffer page header, which is an out-of-bounds kernel write.
A:H - Corrupting ring-buffer event headers or the next sub-buffer page metadata can oops or panic the tracer or hang consumers, and a remote peer can repeat the UDP request to force the overflow until the kernel faults.
| Attack Vector |
Network |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
None |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:N - The nfsd_fh_verify and nfsd_fh_verify_err tracepoints run in the in-kernel NFS server while handling NFSv2/v3 RPCs on UDP/2049; a remote packet reaches svc_udp_recvfrom, svc_process, nfsd_proc_getattr/nfsd3_proc_getattr, then fh_verify.
AC:L - With the nfsd_fh_verify events enabled (a realistic nfsd tracing/perf deployment), every UDP fh_verify deterministically memcpy's 16 or 28 bytes of xpt_local into a 0-byte slot; no race, layout guess, or attacker-uncontrollable condition is required.
PR:N - AUTH_NULL and AUTH_SYS verify no credentials, and GETATTR uses NFSD_MAY_NOP so a dummy filehandle still hits fh_verify (and nfsd_fh_verify_err on lookup failure); a UDP source-IP spoof or wildcard export satisfies the IP map without an authenticated principal.
UI:N - The attacker sends crafted NFS/UDP RPCs unilaterally; no administrator or victim-client action is required at exploitation time, and tracing already being enabled is the scored configuration rather than user interaction.
S:U - The overflow corrupts the host kernel's ftrace/perf ring buffer inside the NFS server's own kernel security authority and does not cross a VM, IOMMU, or sandbox boundary.
C:H - When the reserved sockaddr slot is larger than xpt_locallen, leftover prior ring-buffer contents including kernel pointers from other events leak to trace consumers; the UDP out-of-bounds write can also corrupt adjacent event headers so later parses treat neighbouring kernel memory as payload.
I:H - On NFS/UDP, xpt_remotelen stays 0 so __assign_sockaddr copies 16 or 28 bytes of xpt_local past the reserved dynamic array into subsequent ring-buffer bytes and potentially the next sub-buffer page header, which is an out-of-bounds kernel write.
A:H - Corrupting ring-buffer event headers or the next sub-buffer page metadata can oops or panic the tracer or hang consumers, and a remote peer can repeat the UDP request to force the overflow until the kernel faults.
CVSS 3.1