Linux SUNRPC (xdr_buf_to_bvec, nfsd write path): xdr_buf_to_bvec stores a bio_vec before checking the slot is in range

Impact

xdr_buf_to_bvec stores a bio_vec before checking the slot is in range, so a client-controlled RPC payload size drives an out-of-bounds write into adjacent kernel slab memory on the NFS server. The overflowing values come straight from the client, which makes this a remote kernel memory corruption on the shared file server.

Who can reach it

Any NFS client that can send writes to the server - i.e. any tenant compute node with the export mounted.

What to do

Update the NFS server kernel to one with the bound-check-before-store fix in SUNRPC and reboot. This is in the write path, so there is no useful config workaround short of making the export read-only.

References