russell@unturf.com 652608142a feat: close outreach doc gap — 276 docs (batches 11-16)

All projects with patches now have outreach docs. 276 new docs covering
CWE-407, CWE-312, CWE-362 across C, C++, Java, Python, Go, Rust, C#,
PHP, Ruby, JavaScript, Dart, Erlang, R, and more.

Outreach gap: 276 -> 0.

2026-04-15 13:57:42 -04:00

2.5 KiB

Raw Permalink Blame History

nfs-utils — CWE-407 Disclosure Brief (nfs-utils-0001)

2026-04-13 · Patch available — awaiting upstream merge

Finding

One O(N²) defect in nfs-utils' client hostname lookup during export parsing. Patched. client_lookup() linearly scans the client linked list for non-FQDN hostname matching, producing O(N²) behavior during export file processing.

The Defect

nfs-utils-0001 (PATCHED — HIGH): support/export/client.c:286

// In client_lookup() — fires per export line for non-FQDN clients:
} else {
    for (clp = clientlist[htype]; clp; clp = clp->m_next) {
        if (strcasecmp(hname, clp->m_hostname) == 0)
            break;
    }
}

clientlist is a singly-linked list per client type. For non-FQDN clients (wildcards, netgroups, subnets, GSS identifiers), every client_lookup() call scans the full list. Called once per export line during export_read(), total cost: O(E × C) where E = exports and C = unique clients.

Complexity Proof

At E=5,000 exports, C=1,000 unique clients:

Defective: 5,000 × 500 avg = 2,500,000 string comparisons
Fixed: 5,000 × O(1) hash lookups = 5,000 operations
500× op reduction at scale.

Impact

nfs-utils provides the user-space NFS server and mount utilities for Linux. exportfs and mountd parse /etc/exports at startup and on SIGHUP reload. Large NFS deployments (HPC clusters, enterprise storage) with thousands of export entries experience quadratic startup times. Doubling exports quadruples parsing time.

The Fix

Add a POSIX hsearch_r hash table for O(1) non-FQDN client lookup:

// Before: O(N) linked list scan
for (clp = clientlist[htype]; clp; clp = clp->m_next) {
    if (strcasecmp(hname, clp->m_hostname) == 0) break;
}

// After: O(1) hash lookup
clp = client_ht_lookup(hname);

Patch

Fix available: defects/nfs-utils-0001/patch/nfs-utils-0001.patch

Touches support/export/client.c. Uses POSIX hsearch_r (zero dependency cost). 500× speedup at 5,000 exports / 1,000 clients.

What We Ask

A patch is ready for review.

Confirm receipt and assign an issue reference (linux-nfs/nfs-utils or kernel mailing list).
Assess severity — fires during NFS server startup and config reload.
Coordinate a disclosure date — we are targeting 90 days from first contact.
We will credit the nfs-utils team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.5 KiB Raw Permalink Blame History Unescape Escape