Описание
In the Linux kernel, the following vulnerability has been resolved:
afs: Fix callback service message parsers to pass through -EAGAIN
The AFS filesystem client uses an rxrpc server to listen for callback
notifications. Each callback call type handler has a delivery function
that parses the incoming request stream, and this should return -EAGAIN the
last packet hasn't yet been seen, but all currently queued received data is
consumed. afs_extract_data() does this, but the -EAGAIN return is switched
to 0 inadvertantly
Fix callback service message parsers to pass through -EAGAIN
A flaw was found in the Linux kernel's AFS filesystem client. The AFS client uses an rxrpc server for callback notifications. Its message parsers incorrectly convert the -EAGAIN return value to 0 when the last packet has not been fully received but all currently queued data is consumed. This improper handling of error conditions could lead to unexpected behavior or resource issues within the AFS client.
Отчет
A MODERATE severity flaw was found in the Linux kernel's AFS filesystem client as shipped in Red Hat Enterprise Linux and Red Hat In-Vehicle OS. The AFS client listens for callback notifications on an rxrpc server, and the delivery functions that parse incoming callback request streams incorrectly convert the -EAGAIN return value from afs_extract_data() to 0 when the last packet of a message has not yet been received but all currently queued data has been consumed. As a result, an incomplete callback message can be treated as successfully parsed, causing protocol state confusion. A malicious or compromised AFS fileserver, or an attacker able to tamper with AFS callback traffic, could exploit this by sending a partial callback message to a client that has mounted an AFS share, leading to a denial of service of AFS client callback processing; there is no evidence of memory corruption or privilege escalation, and the impact is limited to availability. Red Hat Enterprise Linux 9 and 10 (kernel and kernel-rt) and Red Hat In-Vehicle OS 2 (kernel and kernel-ivos-qualcomm) are affected, while Red Hat Enterprise Linux 6, 7, and 8 are not affected because the vulnerable code is not present in those streams. Because this is a moderate, availability-only issue whose exposure is limited to systems actually using the AFS filesystem, the fix has been deferred to a future update of the affected streams; the residual risk is potential disruption of AFS callback processing on AFS clients until the fix is delivered. Red Hat's severity (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) is lower than the upstream CVEORG rating of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) because exploitation requires a local client that has mounted an AFS share to receive crafted callback traffic from its AFS fileserver peer, which limits exposure in typical Red Hat deployments.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
5.5 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: afs: Fix callback service message parsers to pass through -EAGAIN The AFS filesystem client uses an rxrpc server to listen for callback notifications. Each callback call type handler has a delivery function that parses the incoming request stream, and this should return -EAGAIN the last packet hasn't yet been seen, but all currently queued received data is consumed. afs_extract_data() does this, but the -EAGAIN return is switched to 0 inadvertantly Fix callback service message parsers to pass through -EAGAIN
In the Linux kernel, the following vulnerability has been resolved: afs: Fix callback service message parsers to pass through -EAGAIN The AFS filesystem client uses an rxrpc server to listen for callback notifications. Each callback call type handler has a delivery function that parses the incoming request stream, and this should return -EAGAIN the last packet hasn't yet been seen, but all currently queued received data is consumed. afs_extract_data() does this, but the -EAGAIN return is switched to 0 inadvertantly Fix callback service message parsers to pass through -EAGAIN
In the Linux kernel, the following vulnerability has been resolved: a ...
EPSS
5.5 Medium
CVSS3