CVE-2010-2521: Buffer Overflow
Description of problem: When readbuf is called to move over to the next page in the pagelist of an NFSv4 request, it sets argp->end to essentially a random number, certainly not an address within the page which argp->p now points to. So subsequent calls to READBUF will think there is much more than a page of spare space (the cast to u32 ensures an unsigned comparison) so we can expect to fall off the end of the second page. We never encountered this in testing because typically the only operations which use more than two pages are write-like operations, which have their own decoding logic. Something like a getattr after a write may cross a page boundary, but it would be very unusual for it to cross another boundary after that.
Upstream commit: http://git.kernel.org/linus/2bc3c1179c781b359d4f2f3439cb3df72afc17fc
Other sources
Multiple buffer overflows in fs/nfsd/nfs4xdr.c in the XDR implementati ...
— Debian
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Fixed in 2.6.34-rc6
Event History
Frequently Asked Questions
What is the severity of CVE-2010-2521?
CVE-2010-2521 has a medium severity rating due to potential impacts on system stability and security.
How do I fix CVE-2010-2521?
To fix CVE-2010-2521, update your Linux kernel to a version that includes the patch addressing this vulnerability.
Which versions of the Linux kernel are affected by CVE-2010-2521?
CVE-2010-2521 affects multiple versions of the Linux kernel up to and including 2.6.34.
What types of systems are at risk from CVE-2010-2521?
Systems running vulnerable Linux kernel versions that utilize NFSv4 requests are at risk from CVE-2010-2521.
Can CVE-2010-2521 lead to data loss?
Yes, CVE-2010-2521 may lead to data corruption or loss depending on the operations being performed on the affected NFSv4 requests.