[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Thu, 22 Oct 2009 15:39:00 -0400 (EDT)
From: Josh Bressers <bressers@...hat.com>
To: oss-security@...ts.openwall.com
Cc: "Steven M. Christey" <coley@...us.mitre.org>
Subject: Re: CVE request: kernel: nfsd4: fix null dereference
creating nfsv4 callback client
Please use CVE-2009-3623 for this.
--
JB
----- "Eugene Teo" <eugeneteo@...nel.sg> wrote:
> Quoting from upstream patch:
> "On setting up the callback to the client, we attempt to use the same
> authentication flavor the client did. We find an rpc cred to use by
> calling rpcauth_lookup_credcache(), which assumes that the given
> authentication flavor has a credentials cache. However, this is not
> required to be true--in particular, auth_null does not use one.
> Instead,
> we should call the auth's lookup_cred() method.
>
> Without this, a client attempting to mount using nfsv4 and auth_null
> triggers a null dereference."
>
> The code was introduced in upstream commit 3cef9ab2 (v2.6.31-rc1),
> fixed
> in 886e3b7f (v2.6.32-rc1), and was later replaced by 80fc015b in the
> same version.
>
> References:
> http://article.gmane.org/gmane.linux.nfs/26513
> https://bugzilla.redhat.com/show_bug.cgi?id=530269
> http://git.kernel.org/linus/3cef9ab266a932899e756f7e1ea7a988a97bf3b2
> http://git.kernel.org/linus/886e3b7fe6054230c89ae078a09565ed183ecc73
> http://git.kernel.org/linus/80fc015bdfe1f5b870c1e1ee02d78e709523fee7
>
> Thanks, Eugene
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
