CVE-2021-47213 Information

Description

In the Linux kernel the following vulnerability has been resolved:

NFSD: Fix exposure in nfsd4_decode_bitmap()

rtm@csail.mit.edu reports:

nfsd4_decode_bitmap4() will write beyond bmval[bmlen-1] if the RPC directs it to do so. This can cause nfsd4_decode_state_protect4_a() to write client-supplied data beyond the end of nfsd4_exchange_id.spo_must_allow[] when called by nfsd4_decode_exchange_id().

Rewrite the loops so nfsd4_decode_bitmap() cannot iterate beyond @bmlen.

Reported by: rtm@csail.mit.edu

Reference

https://git.kernel.org/stable/c/10c22d9519f3f5939de61a1500aa3a926b778d3a https://git.kernel.org/stable/c/c0019b7db1d7ac62c711cda6b357a659d46428fe