OESA-2026-4730: libnfs security update
Package contains a library of functions for accessing NFSv2 and NFSv3 servers from user space. It provides a low-level,asynchronous RPC library for accessing NFS protocols, an asynchronous library with POSIX-like VFS functions,and a synchronous library with POSIX-like VFS functions. Security Fix(es):
ZDR decoding in libnfs through 6.0.2 before 7613236 has an out-of-bounds write related to lib/libnfs-zdr.c with libnfszdrbytes(), libnfszdrstring(), and libnfszdrarray(). The caller-supplied maxsize value is not honored.(CVE-2026-108985)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/libnfsto a version that resolves this vulnerability.Fixed in 5.0.2-4.oe2403sp3 - Upgrade
Upgrade
libnfsto a version that resolves this vulnerability.Patch 7613236
Event History
Frequently Asked Questions
What conditions are required to exploit this issue?
An attacker must be able to cause a vulnerable libnfs consumer to decode malicious ZDR data. The supplied severity vector indicates network reachability, low attack complexity, no required privileges, and required user interaction.
What is the impact of a successful exploit?
The flaw can cause an out-of-bounds write because caller-supplied maximum-size limits are not honored during ZDR decoding. The reported impact is high availability impact and low integrity impact, with no confidentiality impact.
Which libnfs versions are affected?
The issue affects libnfs through version 6.0.2 when built before commit 7613236. The advisory does not identify the fixed package version for openEuler.