CVE-2025-38571

In the Linux kernel, the following vulnerability has been resolved:

sunrpc: fix client side handling of tls alerts

A security exploit was discovered in NFS over TLS in tls_alert_recv due to its assumption that there is valid data in the msghdr's iterator's kvec.

Instead, this patch proposes the rework how control messages are setup and used by sock_recvmsg().

If no control message structure is setup, kTLS layer will read and process TLS data record types. As soon as it encounters a TLS control message, it would return an error. At that point, NFS can setup a kvec backed control buffer and read in the control message such as a TLS alert. Scott found that a msg iterator can advance the kvec pointer as a part of the copy process thus we need to revert the iterator before calling into the tls_alert_recv.

A remotely reachable bug in the SUNRPC NFS-over-TLS client allowed a server to trigger a kernel crash by sending a TLS alert when the client assumed a valid control kvec in the message iterator. It requires NFS over TLS to be enabled on the client. Exploitation is only possible in configurations where NFS over TLS is enabled, as the bug lies in the handling of TLS alert control messages in sunrpc. A remote attacker controlling an NFS/TLS session could send a crafted TLS alert to trigger a kernel crash on the client, leading to denial of service. However, since NFS over TLS is not enabled by default on most systems, the practical severity is lower unless explicitly deployed.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent module sunrpc from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.