CVE-2021-47366: afs: Fix corruption in reads at fpos 2G-4G from an OpenAFS server
In the Linux kernel, the following vulnerability has been resolved:
afs: Fix corruption in reads at fpos 2G-4G from an OpenAFS server
AFS-3 has two data fetch RPC variants, FS.FetchData and FS.FetchData64, and Linux's afs client switches between them when talking to a non-YFS server if the read size, the file position or the sum of the two have the upper 32 bits set of the 64-bit value.
This is a problem, however, since the file position and length fields of FS.FetchData are signed 32-bit values.
Fix this by capturing the capability bits obtained from the fileserver when it's sent an FS.GetCapabilities RPC, rather than just discarding them, and then picking out the VICEDCAPABILITY64BITFILES flag. This can then be used to decide whether to use FS.FetchData or FS.FetchData64 - and also FS.StoreData or FS.StoreData64 - rather than using upper32bits() to switch on the parameter values.
This capabilities flag could also be used to limit the maximum size of the file, but all servers must be checked for that.
Note that the issue does not exist with FS.StoreData - that uses unsigned 32-bit values. It's also not a problem with Auristor servers as its YFS.FetchData64 op uses unsigned 64-bit values.
This can be tested by cloning a git repo through an OpenAFS client to an OpenAFS server and then doing "git status" on it from a Linux afs client[1]. Provided the clone has a pack file that's in the 2G-4G range, the git status will show errors like:
error: packfile .git/objects/pack/pack-5e813c51d12b6847bbc0fcd97c2bca66da50079c.pack does not match index error: packfile .git/objects/pack/pack-5e813c51d12b6847bbc0fcd97c2bca66da50079c.pack does not match index
This can be observed in the server's FileLog with something like the following appearing:
Sun Aug 29 19:31:39 2021 SRXAFSFetchData, Fid = 2303380852.491776.3263114, Host 192.168.11.201:7001, Id 1001 Sun Aug 29 19:31:39 2021 CheckRights: len=0, for host=192.168.11.201:7001 Sun Aug 29 19:31:39 2021 FetchDataRXStyle: Pos 18446744071815340032, Len 3154 Sun Aug 29 19:31:39 2021 FetchDataRXStyle: file size 2400758866 ... Sun Aug 29 19:31:40 2021 SRXAFSFetchData returns 5
Note the file position of 18446744071815340032. This is the requested file position sign-extended.
Affected Software
Event History
Frequently Asked Questions
What types of systems are affected by CVE-2021-47366?
CVE-2021-47366 affects the Linux kernel and OpenAFS implementations.
What is the severity level of CVE-2021-47366?
CVE-2021-47366 has a medium severity due to the potential for data corruption.
How do I fix CVE-2021-47366?
To fix CVE-2021-47366, update to the latest version of the Linux kernel or OpenAFS that addresses this vulnerability.
What is the nature of the vulnerability in CVE-2021-47366?
CVE-2021-47366 involves corruption in reads for file positions between 2G and 4G from an OpenAFS server.
Is there a workaround for CVE-2021-47366?
There are no known workarounds for CVE-2021-47366, so applying the patch is the recommended action.