linux kernel 2.6.25.15 nfsd4: fix null dereference creating nfsv4 callback

2009.11.05
Risk: High
Local: No
Remote: Yes
CWE: CWE-287


CVSS Base Score: 7.8/10
Impact Subscore: 6.9/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: None
Integrity impact: None
Availability impact: Complete

Quoting from upstream patch: "On setting up the callback to the client, we attempt to use the same authentication flavor the client did. We find an rpc cred to use by calling rpcauth_lookup_credcache(), which assumes that the given authentication flavor has a credentials cache. However, this is not required to be true--in particular, auth_null does not use one. Instead, we should call the auth's lookup_cred() method. Without this, a client attempting to mount using nfsv4 and auth_null triggers a null dereference." The code was introduced in upstream commit 3cef9ab2 (v2.6.31-rc1), fixed in 886e3b7f (v2.6.32-rc1), and was later replaced by 80fc015b in the same version. References: http://article.gmane.org/gmane.linux.nfs/26513 https://bugzilla.redhat.com/show_bug.cgi?id=530269 http://git.kernel.org/linus/3cef9ab266a932899e756f7e1ea7a988a97bf3b2 http://git.kernel.org/linus/886e3b7fe6054230c89ae078a09565ed183ecc73 http://git.kernel.org/linus/80fc015bdfe1f5b870c1e1ee02d78e709523fee7 Thanks, Eugene

References:

https://bugzilla.redhat.com/show_bug.cgi?id=530269
http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.32-rc1
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.31.2
http://marc.info/?l=oss-security&m=125624036516377&w=2
http://marc.info/?l=oss-security&m=125618753029631&w=2
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=886e3b7fe6054230c89ae078a09565ed183ecc73
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=80fc015bdfe1f5b870c1e1ee02d78e709523fee7


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top