CVE-2017-8797: Out-of-bounds Read
The NFSv4 server in the Linux kernel before 4.11.3 does not properly validate the layout type when processing the NFSv4 pNFS GETDEVICEINFO or LAYOUTGET operand in a UDP packet from a remote attacker. This type value is uninitialized upon encountering certain error conditions. This value is used as an array index for dereferencing, which leads to an OOPS and eventually a DoS of knfsd and a soft-lockup of the whole system.
Other sources
The NFSv4 server in the Linux kernel does not properly validate layout type when processing NFSv4 pNFS LAYOUTGET operand. The provided input value is not properly validated and is used for array dereferencing. OOPS is triggered which leads to DoS of knfsd and eventually to soft-lockup of whole system. In addition, on normal processing path there is a C undefined behavior weakness that can lead to out of bounds array dereferencing.
The attack vector requires that the attack host is within host mask of exported NFSv4 mount or source address spoofing is not properly mitigated in the network. The attack payload fits to single one-way UDP packet. The kernel must be compiled with CONFIGNFSDPNFS enabled.
References:
http://seclists.org/oss-sec/2017/q2/615
Upstream fixes:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b550a32e60a4941994b437a8d662432a486235a5
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f961e3f2acae94b727380c0b74e2d3954d0edf79
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2017-8797?
CVE-2017-8797 has been rated as having a Medium severity level due to its potential impact on system integrity.
How do I fix CVE-2017-8797?
To fix CVE-2017-8797, you should upgrade to Linux kernel version 4.11.3 or later.
What are the affected versions for CVE-2017-8797?
CVE-2017-8797 affects Linux kernel versions prior to 4.11.3, including specific versions between 4.0 to 4.1.40, 4.2 to 4.4.70, and 4.5 to 4.9.30.
Can CVE-2017-8797 be exploited remotely?
Yes, CVE-2017-8797 can be exploited remotely through crafted UDP packets sent from an attacker.
Is CVE-2017-8797 related to NFSv4?
Yes, CVE-2017-8797 specifically pertains to a vulnerability in the NFSv4 server implementation in the Linux kernel.