oss-security - CVE request: kernel: nfsd4: fix null dereference creating nfsv4 callback client

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Thu, 22 Oct 2009 12:58:21 +0800
From: Eugene Teo <eugeneteo@...nel.sg>
To: oss-security@...ts.openwall.com
CC: "Steven M. Christey" <coley@...us.mitre.org>
Subject: CVE request: kernel: nfsd4: fix null dereference creating nfsv4 callback
 client

Quoting from upstream patch:
"On setting up the callback to the client, we attempt to use the same
authentication flavor the client did.  We find an rpc cred to use by 
calling rpcauth_lookup_credcache(), which assumes that the given 
authentication flavor has a credentials cache.  However, this is not 
required to be true--in particular, auth_null does not use one. Instead, 
we should call the auth's lookup_cred() method.

Without this, a client attempting to mount using nfsv4 and auth_null 
triggers a null dereference."

The code was introduced in upstream commit 3cef9ab2 (v2.6.31-rc1), fixed 
in 886e3b7f (v2.6.32-rc1), and was later replaced by 80fc015b in the 
same version.

References:
http://article.gmane.org/gmane.linux.nfs/26513
https://bugzilla.redhat.com/show_bug.cgi?id=530269
http://git.kernel.org/linus/3cef9ab266a932899e756f7e1ea7a988a97bf3b2
http://git.kernel.org/linus/886e3b7fe6054230c89ae078a09565ed183ecc73
http://git.kernel.org/linus/80fc015bdfe1f5b870c1e1ee02d78e709523fee7

Thanks, Eugene

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.