Description

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field gss_krb5_unwrap_v2() sets buf->len to a logical length, which can be much smaller than head[0].iov_len (the allocated receive-page capacity). It then calls xdr_buf_trim() with a trim length derived from the 16-bit "extra count" (ec) field in the Kerberos v2 token header. The ec field is authenticated by the post-decrypt memcmp() against the encrypted header copy, so a randomly-mutated value is rejected. However, any peer holding a valid GSS context can legitimately encrypt a token whose ec exceeds the plaintext length. Per RFC 4121, such a token is structurally malformed. Although xdr_buf_trim() now clamps the buf->len subtraction to avoid unsigned underflow, the buffer is still left in a semantically invalid state (zero length, inconsistent iov lengths) when ec is oversized. Reject these tokens before calling xdr_buf_trim(), giving callers a well-defined GSS_S_DEFECTIVE_TOKEN error and keeping the xdr_buf internally consistent. The wrapped blob begins at a nonzero offset -- both callers pass len as offset + opaque_len -- so buf->len still counts the offset bytes that precede the blob. Compare the trim length against the remaining wrapped segment, buf->len - offset, rather than the whole buffer; comparing against buf->len alone leaves an offset-wide window in which an oversized ec passes the test and xdr_buf_trim() cuts into the bytes ahead of the blob.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-11T20:19:36.850Z",
  "pubdate": "2026-09-11T20:19:36.850Z",
  "executiveSummary": "The Linux kernel's SUNRPC implementation contains a vulnerability in the gss_krb5_unwrap_v2() function where insufficiently validated 'extra count' (ec) fields in Kerberos v2 tokens can lead to inconsistent internal buffer states.\nThis flaw allows a remote attacker with a valid GSS context to transmit a malformed, yet cryptographically valid, token that forces the XDR buffer into an invalid semantic state.\nThe vulnerability manifests as an improper handling of buffer lengths when the ec field exceeds the actual plaintext length of the wrapped token.\nThe primary risk involves triggering an internal inconsistency that may cause subsequent processing errors, potential memory management issues, or denial-of-service conditions within the RPC subsystem.\nExploitation requires the attacker to possess a legitimate GSS context, as the corrupted ec field is protected by cryptographic integrity checks. The impact is limited to the integrity of the RPC buffer management logic rather than direct arbitrary code execution.",
  "technicalDetails": "The vulnerability resides within gss_krb5_unwrap_v2() in the SUNRPC implementation of the Linux kernel. The function processes Kerberos v2 wrap tokens, which include an 'extra count' (ec) field. This field is intended to specify the amount of 'extra' data (such as padding or trailers) contained within the wrapped token structure.\nThe root cause is a failure to properly sanitize the ec field against the actual payload length before invoking xdr_buf_trim(). While the kernel previously added checks to prevent unsigned integer underflow during the subtraction, it failed to ensure that the resultant buffer state remained semantically valid.\nThe attack flow begins when a peer, authenticated via a valid GSS context, constructs a token where the ec value is technically valid within the encrypted header—passing the subsequent memcmp() integrity check—but exceeds the actual length of the encapsulated plaintext data.\nBecause the gss_krb5_unwrap_v2() function calculates the trim length based on this oversized ec value, the call to xdr_buf_trim() may incorrectly modify the buffer boundaries. Specifically, if the check against the total buffer length is insufficient, the operation can encroach upon the prefix bytes (the offset) that precede the wrapped blob.\nThis behavior leaves the xdr_buf structure in a corrupted state, characterized by a zero-length result or inconsistent iov lengths between the head and the remainder of the buffer. This inconsistency arises because the logic fails to account for the offset, which represents the portion of the buffer preceding the actual wrapped segment.\nBy failing to reject these tokens early, the kernel allows the malformed data to proceed to subsequent processing layers. An attacker can use this to cause the RPC subsystem to perform out-of-bounds operations on the buffer metadata or induce a denial-of-service by forcing the system into an invalid state that standard error recovery routines cannot gracefully manage.\nThe fix involves validating the ec field specifically against the length of the remaining wrapped segment (buf->len - offset) rather than the entire buffer. This ensures that the trim operation is strictly constrained to the payload and prevents the unintentional truncation of critical metadata or buffer headers."
}