CVE-2021-47366

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

afs: Fix corruption in reads at fpos 2G-4G from an OpenAFS server

AFS-3 has two data fetch RPC variants, FS.FetchData and FS.FetchData64, and

Linux's afs client switches between them when talking to a non-YFS server

if the read size, the file position or the sum of the two have the upper 32

bits set of the 64-bit value.

This is a problem, however, since the file position and length fields of

FS.FetchData are *signed* 32-bit values.

Fix this by capturing the capability bits obtained from the fileserver when

it's sent an FS.GetCapabilities RPC, rather than just discarding them, and

then picking out the VICED_CAPABILITY_64BITFILES flag. This can then be

used to decide whether to use FS.FetchData or FS.FetchData64 - and also

FS.StoreData or FS.StoreData64 - rather than using upper_32_bits() to

switch on the parameter values.

This capabilities flag could also be used to limit the maximum size of the

file, but all serv

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References