Описание
In the Linux kernel, the following vulnerability has been resolved:
NFSD: Prevent a potential integer overflow
If the tag length is >= U32_MAX - 3 then the "length + 4" addition
can result in an integer overflow. Address this by splitting the
decoding into several steps so that decode_cb_compound4res() does
not have to perform arithmetic on the unsafe length value.
A flaw was found in the Linux kernel's Network File System daemon (NFSD). An integer overflow vulnerability exists in the callback response decoding process when handling excessively large tag lengths. A remote attacker could exploit this flaw by sending a specially crafted callback response to the NFS server, potentially resulting in a system crash and a Denial of Service (DoS).
Меры по смягчению последствий
If the system does not need to operate as an NFS server, stop and disable the nfs-server service. If the NFS server must remain active, restrict network access to trusted client hosts or networks using firewalld.
- To disable the NFS server: systemctl stop nfs-server systemctl disable nfs-server
- Alternatively, to restrict NFS access to a trusted subnet (e.g., 192.168.1.0/24) via firewalld: firewall-cmd --permanent --zone=public --remove-service=nfs firewall-cmd --permanent --zone=trusted --add-source=192.168.1.0/24 firewall-cmd --permanent --zone=trusted --add-service=nfs firewall-cmd --reload Caveats: Stopping the NFS service prevents remote systems from mounting or accessing exported file systems. Firewall restrictions will block any clients outside the authorized IP ranges. Warning: Stopping the nfs-server service or reloading firewall configurations will disconnect active NFS sessions and can disrupt dependent applications.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | kernel | Out of support scope | ||
| Red Hat Enterprise Linux 7 | kernel | Out of support scope | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Out of support scope | ||
| Red Hat Enterprise Linux 8 | kernel | Out of support scope | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Out of support scope | ||
| Red Hat Enterprise Linux 9 | kernel | Fixed | RHSA-2025:6966 | 13.05.2025 |
| Red Hat Enterprise Linux 9 | kernel | Fixed | RHSA-2025:6966 | 13.05.2025 |
Показывать по
Дополнительная информация
Статус:
EPSS
5.5 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent a potential integer overflow If the tag length is >= U32_MAX - 3 then the "length + 4" addition can result in an integer overflow. Address this by splitting the decoding into several steps so that decode_cb_compound4res() does not have to perform arithmetic on the unsafe length value.
In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent a potential integer overflow If the tag length is >= U32_MAX - 3 then the "length + 4" addition can result in an integer overflow. Address this by splitting the decoding into several steps so that decode_cb_compound4res() does not have to perform arithmetic on the unsafe length value.
In the Linux kernel, the following vulnerability has been resolved: N ...
In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent a potential integer overflow If the tag length is >= U32_MAX - 3 then the "length + 4" addition can result in an integer overflow. Address this by splitting the decoding into several steps so that decode_cb_compound4res() does not have to perform arithmetic on the unsafe length value.
EPSS
5.5 Medium
CVSS3