OpenAFS Master Repository branch, openafs-stable-1_8_x, updated. openafs-stable-1_8_2

Gerrit Code Review
Tue, 11 Sep 2018 15:00:52 -0400

The following commit has been merged in the openafs-stable-1_8_x branch:
commit 4218dc0a2db75c740d1d31966e672f85ad7999bd
Author: Mark Vitale <>
Date:   Thu Jul 5 21:11:30 2018 -0400

    OPENAFS-SA-2018-003 vlserver: prevent unbounded input to VL_RegisterAddrs
    VL_RegisterAddrs is defined with an input argument of type bulkaddrs,
    which is defined to XDR as an unbounded array of afs_uint32 (IPv4 addresses):
      typedef afs_uint32 bulkaddrs<>
    The <> with no value instructs rxgen to build client and server stubs
    that allow for a maximum size of "~0u" or 0xFFFFFFFF.
    Ostensibly the bulkaddrs array is unbounded to allow it to be shared
    among VL_RegisterAddrs, VL_GetAddrs, and VL_GetAddrsU.  The VL_GetAddrs*
    RPCs use bulkaddrs as an output array with a maximum size of MAXSERVERID
    (254). VL_RegisterAddrss uses bulkaddrs as an input array, with a
    nominal size of VL_MAXIPADDRS_PERMH (16).
    However, RPCs with unbounded array inputs are susceptible to remote
    denial-of-service attacks.  That is, a malicious client may send a
    VL_RegisterAddrs request with an arbitrarily long array, forcing the
    vlserver to expend large amounts of network bandwidth, cpu cycles, and
    heap memory to unmarshal the argument.  Even though VL_RegisterAddrs
    requires superuser authorization, this attack is exploitable by
    non-authorized actors because XDR unmarshalling happens long before any
    authorization checks can occur.
    Because all uses of the type that our implementation support have fixed
    bounds on valid data (whether input or output), apply an arbitrary
    implementation limit (larger than any valid structure would be), to
    prevent this class of attacks in the XDR decoder.
    [ limit the bulkaddrs type instead of introducing a new type]
    (cherry picked from commit 7629209219bbea3f127b33be06ac427ebc3a559e)
    Change-Id: I1726a834eb98b7e06285bac78a74e20bbedb9ce8

 src/vlserver/vldbint.xg |    7 ++++++-
 1 files changed, 6 insertions(+), 1 deletions(-)

OpenAFS Master Repository