[prev in list] [next in list] [prev in thread] [next in thread]
List: oss-security
Subject: Re: [oss-security] CVE request: kernel: nfsd4: fix null dereference
From: Josh Bressers <bressers () redhat ! com>
Date: 2009-10-22 19:39:00
Message-ID: 886176164.905141256240340575.JavaMail.root () zmail01 ! collab ! prod ! int ! phx2 ! redhat ! com
[Download RAW message or body]
Please use CVE-2009-3623 for this.
--
JB
----- "Eugene Teo" <eugeneteo@kernel.sg> wrote:
> Quoting from upstream patch:
> "On setting up the callback to the client, we attempt to use the same
> authentication flavor the client did. We find an rpc cred to use by
> calling rpcauth_lookup_credcache(), which assumes that the given
> authentication flavor has a credentials cache. However, this is not
> required to be true--in particular, auth_null does not use one.
> Instead,
> we should call the auth's lookup_cred() method.
>
> Without this, a client attempting to mount using nfsv4 and auth_null
> triggers a null dereference."
>
> The code was introduced in upstream commit 3cef9ab2 (v2.6.31-rc1),
> fixed
> in 886e3b7f (v2.6.32-rc1), and was later replaced by 80fc015b in the
> same version.
>
> References:
> http://article.gmane.org/gmane.linux.nfs/26513
> https://bugzilla.redhat.com/show_bug.cgi?id=530269
> http://git.kernel.org/linus/3cef9ab266a932899e756f7e1ea7a988a97bf3b2
> http://git.kernel.org/linus/886e3b7fe6054230c89ae078a09565ed183ecc73
> http://git.kernel.org/linus/80fc015bdfe1f5b870c1e1ee02d78e709523fee7
>
> Thanks, Eugene
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic