From: Sebastian Josue Alba Vives Date: Thu, 9 Apr 2026 16:44:40 +0000 (-0600) Subject: net: nfs: fix buffer overflow in nfs_readlink_reply() X-Git-Tag: v2026.07-rc2~15^2~16 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=d6694018eaddefac6aae974f9cec72fd6e58f1bc;p=thirdparty%2Fu-boot.git net: nfs: fix buffer overflow in nfs_readlink_reply() nfs_readlink_reply() validates rlen only against the incoming packet length (inherited from CVE-2019-14195), but not against the destination buffer nfs_path_buff[2048]. A malicious NFS server can send a valid READLINK reply where pathlen + rlen exceeds sizeof(nfs_path_buff), overflowing the BSS buffer into adjacent memory. The recent fix in fd6e3d34097f addressed the same overflow class in net/lwip/nfs.c but left the legacy path in net/nfs-common.c unpatched. Add bounds checks before both memcpy calls in nfs_readlink_reply(): - relative path branch: reject if pathlen + rlen >= sizeof(nfs_path_buff) - absolute path branch: reject if rlen >= sizeof(nfs_path_buff) Fixes: cf3a4f1e86 ("net: nfs: Fix CVE-2019-14195") Cc: stable@vger.kernel.org Signed-off-by: Sebastian Alba Vives Reviewed-by: Jerome Forissier --- diff --git a/net/nfs-common.c b/net/nfs-common.c index 4fbde67a760..72d8fd823e3 100644 --- a/net/nfs-common.c +++ b/net/nfs-common.c @@ -674,11 +674,15 @@ static int nfs_readlink_reply(uchar *pkt, unsigned int len) strcat(nfs_path, "/"); pathlen = strlen(nfs_path); + if (pathlen + rlen >= sizeof(nfs_path_buff)) + return -NFS_RPC_DROP; memcpy(nfs_path + pathlen, (uchar *)&rpc_pkt.u.reply.data[2 + nfsv3_data_offset], rlen); nfs_path[pathlen + rlen] = 0; } else { + if (rlen >= sizeof(nfs_path_buff)) + return -NFS_RPC_DROP; memcpy(nfs_path, (uchar *)&rpc_pkt.u.reply.data[2 + nfsv3_data_offset], rlen);