The Linux kernel's SUNRPC implementation had a vulnerability in the gss_krb5_verify_mic_v2 function where it did not verify the length of the MIC token before accessing its fields. This allowed a malicious NFS server to supply a short MIC token, causing the verifier to read beyond the allocated buffer, potentially leading to memory safety issues. Multiple callers accepted short tokens without sufficient length validation. The patch adds a length guard at the start of gss_krb5_verify_mic_v2 to ensure tokens meet the minimum size requirements before processing. Well-formed tokens generated by gss_krb5_get_mic_v2 remain unaffected.

The vulnerability could allow a malicious NFS server to cause the Linux kernel's Kerberos MIC verifier to read beyond allocated memory buffers by supplying short MIC tokens. This out-of-bounds read could lead to memory safety issues such as information disclosure or kernel instability. However, there is no indication of known exploits in the wild, and the impact is limited to scenarios involving malicious NFS servers interacting with the affected kernel component.

A fix has been implemented that adds a length check at the start of the gss_krb5_verify_mic_v2 function to reject short MIC tokens before any memory access occurs. This prevents out-of-bounds reads caused by short tokens. Users should apply the official Linux kernel update that includes this patch to remediate the vulnerability. Until patched, caution should be exercised when interacting with untrusted NFS servers.