Threats Tagged 'cve-2025-40210'

A vulnerability in the Linux kernel's NFS server (NFSD) component involves the removal of a cap on the number of operations per NFSv4 COMPOUND request. This flaw allows an attacker to specify an arbitrarily large operation count in the COMPOUND header, causing the kernel to attempt excessive memory allocation, leading to a denial of service (system hang or crash). The issue was identified and addressed by reverting the commit that removed the cap, restoring a limit of 200 operations per COMPOUND request.

In the Linux kernel, the following vulnerability has been resolved: Revert "NFSD: Remove the cap on number of operations per NFSv4 COMPOUND" I've found that pynfs COMP6 now leaves the connection or lease in a strange state, which causes CLOSE9 to hang indefinitely. I've dug into it a little, but I haven't been able to root-cause it yet. However, I bisected to commit 48aab1606fa8 ("NFSD: Remove the cap on number of operations per NFSv4 COMPOUND"). Tianshuo Han also reports a potential vulnerability when decoding an NFSv4 COMPOUND. An attacker can place an arbitrarily large op count in the COMPOUND header, which results in: [ 51.410584] nfsd: vmalloc error: size 1209533382144, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0 when NFSD attempts to allocate the COMPOUND op array. Let's restore the operation-per-COMPOUND limit, but increased to 200 for now.