Linux NFS server (nfsd, NFSv4 COMPOUND tag decode): An NFSv4 COMPOUND tag length near U32_MAX overflows the length+4

Impact

An NFSv4 COMPOUND tag length near U32_MAX overflows the length+4 arithmetic, producing a wrong allocation and out-of-bounds access on the server. A single crafted COMPOUND from an unauthenticated client crashes the shared file server.

Who can reach it

Any host that can send an NFSv4 COMPOUND to the server's RPC port.

What to do

Update the storage server kernel and reboot. No config workaround - COMPOUND is the base NFSv4 transport unit.

References