The Linux kernel NFSv2 sattr decoder previously converted useconds to nanoseconds without properly guarding against out-of-range values. On 32-bit ILP32 systems, large useconds values caused integer wraparound, resulting in corrupted nanosecond timestamps that passed later range checks and were accepted by the server. Since NFSv2 does not define an NFS-level error for invalid time arguments, the check could not be deferred to later processing. The vulnerability was addressed by adding a guard in the decoder to reject useconds values greater than 1,000,000, except for the Sun convention value of exactly 1,000,000 which is used to indicate setting the time to the current server time. Additionally, the patch applies this convention symmetrically to both atime and mtime fields, clearing the appropriate attribute flags to prevent malformed values from being used.

This vulnerability could allow malformed time values to be accepted by the NFSv2 server, potentially leading to corrupted file timestamps or unexpected behavior in file attribute handling. The issue arises from integer wraparound during conversion of useconds to nanoseconds on 32-bit systems. The fix prevents out-of-range values from being accepted, thus preserving correct time semantics and preventing corruption.

A fix has been implemented in the Linux kernel to reject out-of-range useconds values in NFSv2 SETATTR and CREATE operations. Users should update to a Linux kernel version that includes this patch to mitigate the vulnerability. No additional mitigation steps are indicated beyond applying the official fix.