oss-security - Re: CVE request: kernel: nfsd4: fix null dereference creating nfsv4 callback client

Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Thu, 22 Oct 2009 15:39:00 -0400 (EDT)
From: Josh Bressers <bressers@...hat.com>
To: oss-security@...ts.openwall.com
Cc: "Steven M. Christey" <coley@...us.mitre.org>
Subject: Re: CVE request: kernel: nfsd4: fix null dereference
 creating nfsv4 callback client

Please use CVE-2009-3623 for this.

-- 
    JB

----- "Eugene Teo" <eugeneteo@...nel.sg> wrote:

> Quoting from upstream patch:
> "On setting up the callback to the client, we attempt to use the same
> authentication flavor the client did.  We find an rpc cred to use by 
> calling rpcauth_lookup_credcache(), which assumes that the given 
> authentication flavor has a credentials cache.  However, this is not 
> required to be true--in particular, auth_null does not use one.
> Instead, 
> we should call the auth's lookup_cred() method.
> 
> Without this, a client attempting to mount using nfsv4 and auth_null 
> triggers a null dereference."
> 
> The code was introduced in upstream commit 3cef9ab2 (v2.6.31-rc1),
> fixed 
> in 886e3b7f (v2.6.32-rc1), and was later replaced by 80fc015b in the 
> same version.
> 
> References:
> http://article.gmane.org/gmane.linux.nfs/26513
> https://bugzilla.redhat.com/show_bug.cgi?id=530269
> http://git.kernel.org/linus/3cef9ab266a932899e756f7e1ea7a988a97bf3b2
> http://git.kernel.org/linus/886e3b7fe6054230c89ae078a09565ed183ecc73
> http://git.kernel.org/linus/80fc015bdfe1f5b870c1e1ee02d78e709523fee7
> 
> Thanks, Eugene

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.