Linux Kernel NFSD SECINFO_NO_NAME Decode Error Vulnerability

A vulnerability in the Linux kernel's NFS server implementation (NFSD) has been addressed. The issue arose in the SECINFO_NO_NAME decoding process, where the decoder initialized a variable after decoding another, leading to potential errors. If the XDR stream was truncated, the decoder would return an error before properly initializing the variable, causing it to hold outdated information from previous operations. This problem was exacerbated by a change that reduced the clearing of certain data structures between RPC calls, allowing stale data to interfere with the decoding process. The vulnerability could result in improper handling of NFS requests, potentially leading to data corruption or other unintended consequences.

Impact

The vulnerability could cause the NFS server to mismanage SECINFO_NO_NAME requests, leading to errors in file sharing or data access over the network.

Reproduction

To reproduce this vulnerability, send a truncated XDR stream during an NFS operation that requires SECINFO_NO_NAME processing. The server will respond with an error, but the internal state may not be properly reset, allowing stale data to affect subsequent operations.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for upgrading the kernel can be found in the official Linux documentation.