oss-security - Re: CVE request: kernel: nfsd4: fix null dereference creating nfsv4 callback client

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <886176164.905141256240340575.JavaMail.root@zmail01.collab.prod.int.phx2.redhat.com>
Date: Thu, 22 Oct 2009 15:39:00 -0400 (EDT)
From: Josh Bressers <bressers@...hat.com>
To: oss-security@...ts.openwall.com
Cc: "Steven M. Christey" <coley@...us.mitre.org>
Subject: Re: CVE request: kernel: nfsd4: fix null dereference
 creating nfsv4 callback client

Please use CVE-2009-3623 for this.

-- 
    JB

----- "Eugene Teo" <eugeneteo@...nel.sg> wrote:

> Quoting from upstream patch:
> "On setting up the callback to the client, we attempt to use the same
> authentication flavor the client did.  We find an rpc cred to use by 
> calling rpcauth_lookup_credcache(), which assumes that the given 
> authentication flavor has a credentials cache.  However, this is not 
> required to be true--in particular, auth_null does not use one.
> Instead, 
> we should call the auth's lookup_cred() method.
> 
> Without this, a client attempting to mount using nfsv4 and auth_null 
> triggers a null dereference."
> 
> The code was introduced in upstream commit 3cef9ab2 (v2.6.31-rc1),
> fixed 
> in 886e3b7f (v2.6.32-rc1), and was later replaced by 80fc015b in the 
> same version.
> 
> References:
> http://article.gmane.org/gmane.linux.nfs/26513
> https://bugzilla.redhat.com/show_bug.cgi?id=530269
> http://git.kernel.org/linus/3cef9ab266a932899e756f7e1ea7a988a97bf3b2
> http://git.kernel.org/linus/886e3b7fe6054230c89ae078a09565ed183ecc73
> http://git.kernel.org/linus/80fc015bdfe1f5b870c1e1ee02d78e709523fee7
> 
> Thanks, Eugene

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.