Bug 491612 – Kernel : nfs: missing check for buffer length in __nfs4_get_acl_uncached (CVE-2013-4591)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Agostino Sarubbo 2013-11-18 19:37:10 UTC]

From ${URL} :

Commit 1f1ea6c (included in Red Hat Enterprise Linux 6 as part of CVE-2012-2375 fix) accidently 
dropped the checking for too small result buffer length.
   
If someone uses getxattr on "system.nfs4_acl" on an NFSv4 mount supporting ACLs, the ACL has not 
been cached and the buffer suplied is too short, we still copy the complete ACL, resulting in 
kernel and user space memory corruption.

Introduced by:
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=1f1ea6c2d9d8c0be9ec56454b05315273b5de8ce

Upstream commit:
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=7d3e91a89b7adbc2831334def9e494dd9892f9af

[Comment 1 GLSAMaker/CVETool Bot 2013-11-27 21:53:15 UTC]

CVE-2013-4591 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-4591):
  Buffer overflow in the __nfs4_get_acl_uncached function in fs/nfs/nfs4proc.c
  in the Linux kernel before 3.7.2 allows local users to cause a denial of
  service (memory corruption and system crash) or possibly have unspecified
  other impact via a getxattr system call for the system.nfs4_acl extended
  attribute of a pathname on an NFSv4 filesystem.

[Comment 2 John Helmert III 2022-03-25 15:50:04 UTC]

Fix in 3.7.2