Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 26 May 2010 14:45:34 -0400 (EDT)
From: Josh Bressers <bressers@...hat.com>
To: oss-security@...ts.openwall.com
Cc: "Steven M. Christey" <coley@...us.mitre.org>
Subject: Re: CVE request - kernel: nfsd: fix vm overcommit
 crash

Please use CVE-2010-1643 for this.

Thanks.

-- 
    JB

----- "Eugene Teo" <eugeneteo@...nel.sg> wrote:

> "knfsd crashes if you are using it to export shmemfs objects and run 
> strict overcommit. In this situation the current->mm based modifier to
> 
> the overcommit goes through a NULL pointer.
> 
> We could simply check for NULL and skip the modifier but we've caught
> 
> other real bugs in the past from mm being NULL here - cases where we
> did 
> need a valid mm set up (eg the exec bug in 2005).
> 
> To preserve the checks and get the logic we want shuffle the checking
> 
> around and add a new helper to the vm_ security wrappers
> 
> Also fix a current->mm reference in nommu that should use the passed
> mm"
> 
> Upstream commit:
> nfsd: fix vm overcommit crash
> http://git.kernel.org/linus/731572d39fcd3498702eda4600db4c43d51e0b26
> 
> Reference:
> [PATCH] knfsd: add nfs-export support to tmpfs
> http://git.kernel.org/linus/91828a405ae454a9503c41a7744f6ff877a80714
> https://bugzilla.redhat.com/show_bug.cgi?id=595970
> 
> Backtrace (-rt kernel):
> https://bugzilla.redhat.com/show_bug.cgi?id=595970#c1
> 
> Thanks, Eugene
> -- 
> main(i) { putchar(182623909 >> (i-1) * 5&31|!!(i<7)<<6) && main(++i);
> }

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ