gss_unwrap_resp_integ() authenticates only databody_integ. The checksum
object and any bytes after it are not covered by the integrity check, but
remain visible to the XDR decoder.

This makes RPCSEC_GSS reply payloads malleable by bypassing crypto
integrity. A modified reply can contain only the RPCSEC_GSS sequence
number in databody_integ, reuse the reply verifier MIC as the body MIC,
and append bytes that the decoder consumes without invalidating the MIC.

Decode the checksum length into mic.len and truncate the decode stream
after MIC verification so only the authenticated payload remains visible.
Reject bodies shorter than the mandatory sequence number before using the
body length.

Fixes: 1da177e4c3f41 ("Linux-2.6.12-rc2")
Assisted-by: Codex:gpt-5
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
---
Changes in v2:
- Drop the redundant xdr_stream_remaining() guard before truncation.

v1: https://lore.kernel.org/all/20260919212024.2335794-2-Jeremy.Jean@oss.cyber.gouv.fr/

 net/sunrpc/auth_gss/auth_gss.c | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index 8ddc65e894da..b4911b6e69cc 100644
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -2001,7 +2001,7 @@ gss_unwrap_resp_integ(struct rpc_task *task, struct rpc_cred *cred,
 	/* opaque databody_integ<>; */
 	if (xdr_stream_decode_u32(xdr, &len))
 		goto unwrap_failed;
-	if (len & 3)
+	if (len < XDR_UNIT || len & 3)
 		goto unwrap_failed;
 	offset = rcv_buf->len - xdr_stream_remaining(xdr);
 	if (xdr_stream_decode_u32(xdr, &seqno))
@@ -2021,13 +2021,12 @@ gss_unwrap_resp_integ(struct rpc_task *task, struct rpc_cred *cred,
 
 	/* opaque checksum<>; */
 	offset += len;
-	if (xdr_decode_word(rcv_buf, offset, &len))
+	if (xdr_decode_word(rcv_buf, offset, &mic.len))
 		goto unwrap_failed;
 	offset += sizeof(__be32);
-	if (offset + len > rcv_buf->len)
+	if (offset + mic.len > rcv_buf->len)
 		goto unwrap_failed;
-	mic.len = len;
-	mic.data = kmalloc(len, GFP_KERNEL);
+	mic.data = kmalloc(mic.len, GFP_KERNEL);
 	if (ZERO_OR_NULL_PTR(mic.data))
 		goto unwrap_failed;
 	if (read_bytes_from_xdr_buf(rcv_buf, offset, mic.data, mic.len))
@@ -2039,6 +2038,10 @@ gss_unwrap_resp_integ(struct rpc_task *task, struct rpc_cred *cred,
 	if (maj_stat != GSS_S_COMPLETE)
 		goto bad_mic;
 
+	/* Expose only the authenticated payload to the decoder. */
+	xdr_truncate_decode(xdr, xdr_stream_remaining(xdr) -
+			    (len - XDR_UNIT));
+
 	gss_update_rslack(task, cred, 2, 2 + 1 + XDR_QUADLEN(mic.len));
 	ret = 0;
 
-- 
2.47.3

On Sun, 20 Sep 2026 21:07:13 +0000, Jérémy Jean wrote:
> gss_unwrap_resp_integ() authenticates only databody_integ. The checksum
> object and any bytes after it are not covered by the integrity check, but
> remain visible to the XDR decoder.
> 
> This makes RPCSEC_GSS reply payloads malleable by bypassing crypto
> integrity. A modified reply can contain only the RPCSEC_GSS sequence
> number in databody_integ, reuse the reply verifier MIC as the body MIC,
> and append bytes that the decoder consumes without invalidating the MIC.
> 
> [...]

Applied to nfsd-testing, thanks!

[1/1] SUNRPC: restrict integrity replies to authenticated payload
      (no commit info)

--
Chuck Lever

On Sun, Sep 20, 2026, at 5:07 PM, Jérémy Jean wrote:
> gss_unwrap_resp_integ() authenticates only databody_integ. The checksum
> object and any bytes after it are not covered by the integrity check, but
> remain visible to the XDR decoder.
>
> This makes RPCSEC_GSS reply payloads malleable by bypassing crypto
> integrity. A modified reply can contain only the RPCSEC_GSS sequence
> number in databody_integ, reuse the reply verifier MIC as the body MIC,
> and append bytes that the decoder consumes without invalidating the MIC.
>
> Decode the checksum length into mic.len and truncate the decode stream
> after MIC verification so only the authenticated payload remains visible.
> Reject bodies shorter than the mandatory sequence number before using the
> body length.
>
> Fixes: 1da177e4c3f41 ("Linux-2.6.12-rc2")
> Assisted-by: Codex:gpt-5
> Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
> ---
> Changes in v2:
> - Drop the redundant xdr_stream_remaining() guard before truncation.
>
> v1: 
> https://lore.kernel.org/all/20260919212024.2335794-2-Jeremy.Jean@oss.cyber.gouv.fr/
>
>  net/sunrpc/auth_gss/auth_gss.c | 13 ++++++++-----
>  1 file changed, 8 insertions(+), 5 deletions(-)

Reviewed-by: Chuck Lever <cel@kernel.org>

-- 
Chuck Lever (Come to NFS bake-a-thon! https://nfsv4bat.org)