In the Linux kernel, the following vulnerability has been resolved:
afs: Fix callback service message parsers to pass through -EAGAIN
The AFS filesystem client uses an rxrpc server to listen for callback
notifications. Each callback call type handler has a delivery function
that parses the incoming request stream, and this should return -EAGAIN the
last packet hasn't yet been seen, but all currently queued received data is
consumed. afs_extract_data() does this, but the -EAGAIN return is switched
to 0 inadvertantly
Fix callback service message parsers to pass through -EAGAIN
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
None
No data modification
Availability
High
Complete denial of service
CVSS Vector v3.1
References 8
https://git.kernel.org/stable/c/09c67a7ded481482155b836c8c7f078a3075f8de
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/0acbc09d2aca0432af45cec114f20d55ceafaec4
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/0f36469d7ce98b362934113c550d08bb0c784231
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/239cd337c9d047e7097f5b2ebbb41ddfb8180bc6
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/26b737b3769e92493fe94c34620399d93ca231ae
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/5a39b145a8fb49f316e7ec1f29ba51d68095c7e4
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/772850871a2e772e26f9d93f1e9ddd413b3eeaa4
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/f14dd036fad3d359f26f1282199cec06b3a9362b
416baaa9-dc9f-4396-8d5f-8c081fb06d67