Description

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: harden gss_krb5_unwrap_v2 against short tokens gss_krb5_unwrap_v2() reads the EC and RRC header fields at ptr+4 and ptr+6 before validating that the token is at least GSS_KRB5_TOK_HDR_LEN (16) bytes long, and its rotate_left() helper passes buf->len - base to xdr_buf_subsegment() without verifying that base <= buf->len. When a caller hands in a sub-16-byte token, or a token whose declared len leaves base past the end of the buffer, three distinct failures follow: gss_krb5_unwrap_v2(offset, len, buf) ptr = buf->head[0].iov_base + offset ec = *(ptr + 4) /* OOB read on short head */ rrc = *(ptr + 6) /* OOB read on short head */ rotate_left(offset + 16, buf, rrc) xdr_buf_subsegment(buf, &subbuf, base, buf->len - base) /* u32 wrap when base > len */ _rotate_left(&subbuf, shift) shift %= buf->len /* divide-by-zero when base == len */ After decryption, the cleanup arithmetic has the same shape: movelen = min_t(unsigned int, buf->head[0].iov_len, len); movelen -= offset + GSS_KRB5_TOK_HDR_LEN + headskip; BUG_ON(offset + GSS_KRB5_TOK_HDR_LEN + headskip + movelen > buf->head[0].iov_len); The BUG_ON re-adds the value just subtracted, so it reduces to min(A, B) > A and is permanently false; it cannot catch the unsigned underflow of movelen, which then drives a ~UINT_MAX-byte memmove(). Add four defense-in-depth guards inside the unwrap core so it is safe regardless of what its callers validate: - reject tokens with len - offset < GSS_KRB5_TOK_HDR_LEN before touching ptr+4/ptr+6; - bail from rotate_left() when buf->len <= base, covering both the underflow and zero-length cases; - return early from _rotate_left() when buf->len is zero, so the shift %= buf->len modulo cannot fault; - replace the dead BUG_ON with a live check that returns GSS_S_DEFECTIVE_TOKEN before the movelen subtraction.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-11T20:19:37.380Z",
  "pubdate": "2026-09-11T20:19:37.380Z",
  "executiveSummary": "The Linux kernel's SUNRPC implementation contains multiple vulnerabilities in gss_krb5_unwrap_v2() related to improper input validation of GSS-API Kerberos tokens.\nThe flaws allow for out-of-bounds memory reads, integer underflows, and a divide-by-zero exception, which can potentially lead to kernel memory corruption or denial-of-service (DoS) conditions.\nThe vulnerability originates from processing malformed or truncated tokens before performing necessary length checks.\nSuccessful exploitation requires the ability to supply a malicious or specifically crafted GSS-API token to the SUNRPC service, typically over the network.\nImpact includes kernel crashes via divide-by-zero or memory corruption, potentially leading to privilege escalation or system instability depending on the memory layout and attacker influence.",
  "technicalDetails": "The primary root cause resides in the lack of bounds checking in gss_krb5_unwrap_v2() before accessing token header fields. Specifically, the function attempts to read EC and RRC header fields at an offset from the provided buffer pointer before verifying that the token length meets the minimum GSS_KRB5_TOK_HDR_LEN (16 bytes).\nAn out-of-bounds (OOB) read occurs because the code assumes the input token is always of sufficient size. If the length is less than 16 bytes, the pointer arithmetic accesses memory outside the valid bounds of the buffer.\nFurthermore, the rotate_left() helper function fails to validate that the base offset is within the buffer's bounds. This leads to an integer underflow when calculating 'buf->len - base'. When 'base > buf->len', the unsigned integer calculation wraps around to a massive value, which is then passed to xdr_buf_subsegment().\nA divide-by-zero vulnerability occurs within _rotate_left() when 'base == buf->len'. The operation 'shift %= buf->len' triggers a kernel panic as it attempts a modulo operation by zero.\nPost-decryption, the code contains a defective safety check: 'BUG_ON(offset + GSS_KRB5_TOK_HDR_LEN + headskip + movelen > buf->head[0].iov_len)'. Due to algebraic simplification, this check is mathematically equivalent to 'min(A, B) > A', which is always false. This allows an integer underflow in 'movelen' to pass unnoticed, resulting in a memmove() operation with a size of approximately UINT_MAX. This leads to severe kernel heap corruption, overwriting arbitrary memory regions adjacent to the buffer.\nAttackers can leverage this by sending a specially crafted Kerberos token that triggers these arithmetic errors. The vulnerability is reachable via standard RPC operations that utilize Kerberos authentication, exposing the kernel to remote exploitation if an attacker can initiate RPC calls to the target system.\nThe cumulative result of these flaws allows an attacker to manipulate kernel memory or force a system crash, representing a significant risk to the integrity and availability of the Linux kernel."
}