[PATCH] net: nfs: fix buffer overflow in nfs_readlink_reply()

[Sebastián Alba]

Hi Jerome,

Thank you for the review and for adding the patch to your net queue!

Regarding CVE assignment: the GitHub mirror does not have Security
Advisories enabled, and Tom indicated the submitter should request one.
Would it be possible for you or the U-Boot project to request a CVE through
your CNA channel (ARM/Linaro or otherwise)?

Thanks again.

Best regards,
Sebastián Alba Vives


El mar, 14 abr 2026 a las 10:03, Jerome Forissier (<jerome.forissier at arm.com>)
escribió:

> On 09/04/2026 18:44, Sebastian Alba Vives wrote:
> > From: Sebastian Josue Alba Vives <sebasjosue84 at gmail.com>
> >
> > nfs_readlink_reply() validates rlen only against the incoming packet
> > length (inherited from CVE-2019-14195), but not against the destination
> > buffer nfs_path_buff[2048]. A malicious NFS server can send a valid
> > READLINK reply where pathlen + rlen exceeds sizeof(nfs_path_buff),
> > overflowing the BSS buffer into adjacent memory.
> >
> > The recent fix in fd6e3d34097f addressed the same overflow class in
> > net/lwip/nfs.c but left the legacy path in net/nfs-common.c unpatched.
> >
> > Add bounds checks before both memcpy calls in nfs_readlink_reply():
> > - relative path branch: reject if pathlen + rlen >= sizeof(nfs_path_buff)
> > - absolute path branch: reject if rlen >= sizeof(nfs_path_buff)
> >
> > Fixes: cf3a4f1e86 ("net: nfs: Fix CVE-2019-14195")
> > Cc: stable at vger.kernel.org
> > Signed-off-by: Sebastian Alba Vives <sebasjosue84 at gmail.com>
> > ---
> >  net/nfs-common.c | 4 ++++
> >  1 file changed, 4 insertions(+)
> >
> > diff --git a/net/nfs-common.c b/net/nfs-common.c
> > index 4fbde67a..72d8fd82 100644
> > --- a/net/nfs-common.c
> > +++ b/net/nfs-common.c
> > @@ -674,11 +674,15 @@ static int nfs_readlink_reply(uchar *pkt, unsigned
> int len)
> >
> >               strcat(nfs_path, "/");
> >               pathlen = strlen(nfs_path);
> > +             if (pathlen + rlen >= sizeof(nfs_path_buff))
> > +                     return -NFS_RPC_DROP;
> >               memcpy(nfs_path + pathlen,
> >                      (uchar *)&rpc_pkt.u.reply.data[2 +
> nfsv3_data_offset],
> >                      rlen);
> >               nfs_path[pathlen + rlen] = 0;
> >       } else {
> > +             if (rlen >= sizeof(nfs_path_buff))
> > +                     return -NFS_RPC_DROP;
> >               memcpy(nfs_path,
> >                      (uchar *)&rpc_pkt.u.reply.data[2 +
> nfsv3_data_offset],
> >                      rlen);
>
> Reviewed-by: Jerome Forissier <jerome.forissier at arm.com>
>
> Added to my net queue, thanks!
>
> --
> Jerome
>


-- 
Sebastián Alba